[Haoming9527]

Refs #872. Stacked on #912; this is the internal host-admission slice, not closure of the full feature.

What was wrong

The native shell queue could ask for admission but had no host adapter that bound each head to the exact live Agent/Session, current permissions, environment and public sandbox launch. A one-call grant or delayed approval must never authorize later queued commands or a replaced owner.

The change

Add a scoped admission service and bounded shell transport on the existing ready kernel. Every asynchronous preparation boundary rechecks standing authority and owner lifetime. Permission or environment changes retire old state; a wider one-call grant retires its shell before publishing the result. Agent or provider disposal awaits native cleanup. Late approvals are suppressed, and old terminal output collection cannot erase the next queue head's launch facts.

Launches use the running host's public environment scrub and exact sandbox argv. Environment merges handle Windows case and deleted entries, remove the outer control marker, and reject startup scripts without printing their values. Explicit working directories resolve at the head; omission preserves the live shell directory. Terminal output collection joins both streams before releasing the native record and preserves explicit loss/error facts.

This service is internal and is not mounted by the public tool provider in this slice. It does not enable the incompatible shipped Niubash runtime or change schemas, prompts, dependency pins or package versions. Eligible runtime distribution, Native/PTC publication, shared recoverable spill, native fresh/background tasks, Jobs handoff and complete lifecycle/performance acceptance remain required by #872. Bilingual docs and changelog entries describe these limits.

Validation

node scripts/build.mjs passes. With DSH_OPS_REQUIRE_RUNTIME=1 and the exact final queue worker, node test/run.mjs resident-shell-admission resident-shell-channel resident-kernel host-scope-source passes 67 checks in four suites, zero failed or skipped: 29 admission, 14 channel, 18 kernel and six host-scope checks. The suites finish in 14 seconds.

The real public-host admission probe passes 7/7 checks, settling 27 calls and confirming the observed kernel is gone. It covers FIFO and sibling concurrency, file calls during shell work, queue/admission deadlines and cancellation, one-call retirement, policy-change retirement, Agent disposal and bounded terminal output. Actual Cordis, Agents, Sessions, policy, directory, subprocess and sandbox services are used; approval and shell-env inputs are instrumented public service shapes. This is candidate integration evidence, not model-facing or full application acceptance.

Worker SHA-256: 21d3e339830e9fdee9eadd91e51d7bf99e14ecb030213aac3711ca0fabd9530d. Local candidate SHA-256: 7c4332044ac5fd1b789f30b29c155a62f12f07f8dd3495244bda3ce4e0e84664. The runtime candidate is unpublished; no reproducible-release claim is made.

In the paired isolated-source control, the unchanged admission adapter passes 29/29. Removing only its environment identity comparison produces 28 passed / one failed, exit 1: the changed environment incorrectly reuses the old shell. The first isolated copy omitted the trusted workspace preparation script and produced three additional setup failures; those raw results remain recorded. The paired control includes that script and uses the same explicit worker as the passing suite. All 884 tracked code files pass the size limit.

Required pull-request CI is green for 3c276dc2afd9500207dca751923ac972a912f44d: https://github.com/T-Auto/dsh-ops/actions/runs/43473815516 . All required jobs passed, including Windows, Linux, both macOS architectures, Node floor, lint, size and tool trials.

Environment

Windows x64, Node 26.12.1, Rust 1.99.0 locally; CI uses the repository-pinned toolchain. Base: ef2aaac1943e2cbb954909505ff39f8f3a3e7e85. Public DSH packages from the unchanged lockfile. No new dependencies or public schema bytes.