[Haoming9527]

Refs #872. Stacked on #911; this is the native queue slice, not closure of the full feature.

What was wrong

The persistent command driver had no kernel-owned session FIFO, per-request admission lifecycle, queued cancellation or output collection protocol. A stalled host output stream could also delay cancellation while a request waited to publish its start acknowledgement.

The change

Add one FIFO worker per shell owner inside the existing activation-owned kernel. Every queue head requests current host admission; retiring an admission preserves the same unstarted request, while owner retirement cancels the active request and preserves its followers. Queue-inclusive deadlines, cancellation and owner close remain independent of approval callbacks and other sessions. Cleanup joins the owned range and capture readers before publishing terminal state; unconfirmed cleanup prevents that owner from starting another range.

One bounded reply queue keeps the input reader responsive under output backpressure. Start publication waits for the physical write while still observing cancellation and deadlines. Both physical write errors and asynchronous enqueue overflow shut down the private connection immediately. Output reads return bounded prefix snapshots with explicit loss and EOF facts. Windows advertises the internal shell-v1 capability; other platforms explicitly do not.

The regression fixtures import the production manager and use the public host subprocess/confinement APIs. Bilingual documentation and changelog entries describe the limits. Published tools and runtime pins remain unchanged. Public Native/PTC integration, shared recoverable spill, native fresh/background tasks, DSH jobs and full lifecycle/performance acceptance remain required by #872.

Validation

cargo test --locked --manifest-path native/Cargo.toml --workspace: 703 passed, zero failed, three ignored fixtures/platform cases across emitted summaries. The two child fixtures are invoked by their lifecycle tests; Windows CI exercises the existing UNC case separately. Workspace/all-target Clippy and formatting pass. The local Cargo cache reports hard-link fallback warnings; compilation succeeds without weakening checks. The workflow check passes all 117 assertions.

The final worker passes 18 candidate driver acceptance checks (plus the idle-death diagnostic), 7/7 actual host admission checks, and 2/2 stalled-output checks. The held-start fixture passes 3/3 checks: cancellation in workspace-write, owner close in read-only, and deadline expiry in danger-full-access all stop the shell before the start-write gate is released, with no command effect. The stalled-output probe leaves 4,063,232 reply bytes unread while shutdown joins the kernel and quiet child; the sibling kernel remains usable. All lifecycle assertions complete without emergency cleanup being needed.

Final worker SHA-256: 21d3e339830e9fdee9eadd91e51d7bf99e14ecb030213aac3711ca0fabd9530d. The host admission proof uses the separate pending host slice and is integration evidence; this PR's CI validates the exact native slice independently. Required pull-request CI is green for ef2aaac1943e2cbb954909505ff39f8f3a3e7e85: https://github.com/T-Auto/dsh-ops/actions/runs/43472529084 . All required jobs passed, including Windows, Linux, both macOS architectures, Node floor, lint, size and tool trials. All 875 tracked code files pass the size limit.

The deterministic overflow regression holds the writer, fills exactly 256 reply slots, and produces a session completion after the final input frame. It passes with the fatal callback. An external source copy removing only that callback fails 0 passed / 1 failed, exit 101, without another input/reap and with clean teardown.

The held-start negative control replaces only the cancellation-aware acknowledgement wait with a blocking receive. Cancellation then fails to stop the owned shell before the gate is released; the unmodified implementation stops it before release and reports no command effects. Earlier outer-tool-sandbox ACL failures and an invalid Windows half-close test remain recorded. Windows named pipes have no independent write-half EOF; the final stalled-reader probe uses the supported shutdown message while retaining the paused read side.

The full driver proof requires local Niubash candidate SHA-256 7c4332044ac5fd1b789f30b29c155a62f12f07f8dd3495244bda3ce4e0e84664. It is not a published runtime or a cross-build reproducibility claim. CI uses the unchanged stock runtime for the queue lifecycle checks; it does not claim the known asynchronous output-routing defect is fixed.

Environment

Windows x64, Node 26.12.1, Rust 1.99.0 locally; CI uses the repository-pinned toolchain. Base: b32e8f5b2ed99a9617694e26352ebf9a9b6c7b96. Public DSH packages from the unchanged lockfile. No package-version or dependency changes.