[Haoming9527]

Refs #872. Stacked on #913; this is the internal task-capture substrate, not closure of the feature.

What was wrong

The owned Windows process range exposed only joined prefix capture. Fresh commands and Jobs need non-consuming live tail views, and root exit must be distinguished from surviving descendants. Windows Job emptiness can precede the held root handle becoming signalled, so it cannot alone establish a final exit code. The inherited NUL stdin also differed from the existing fresh path's closed-pipe EOF contract.

The change

Share bounded raw capture storage between prefix and tail retention. Independent readers receive raw byte coordinates, observed totals, explicit loss, actual EOF and capture errors; failed reads preserve partial output. Expose process output views and held-handle root exit, and require confirmed root exit before a range is settled. Replace NUL stdin with a closed anonymous pipe while preserving the exact confined argv and explicit inherited handle list.

A repository-only task owner exercises ordinary fresh descendant cleanup separately from explicitly selected background lifetime. It is not a second production scheduler or public Jobs adapter. Bilingual docs, changelog and a Windows CI step cover the new substrate. Public tools, runtime pins and dependency versions remain unchanged. Recoverable raw spill, bounded task wire/scheduling, exact Jobs handoff, public integration and complete performance/lifecycle acceptance remain required by #872.

Validation

The integrated stack passes cargo test --locked --manifest-path native/Cargo.toml --workspace: 708 passed, zero failed, three ignored fixtures/platform cases across emitted summaries. The two process child fixtures are explicitly invoked; Windows CI separately exercises the existing UNC case. Workspace/all-target Clippy with -D warnings, formatting and diff checks pass. All 117 workflow assertions and 887 tracked code files pass their gates.

The public-host task probe passes 10/10 checks, with no observed survivors before emergency cleanup: three permission modes, closed stdin, real exit 259, independent live cursors, two 1 MiB streams under bounded retention, fresh descendant retirement, explicit background lifetime, targeted cancellation and owner EOF. Exact example SHA-256: 96c05d5f99ec0d8b5c51b8dea99ed58ad8d61b9abc1d67849b9b9c8aee12089c. The existing direct driver remains compatible: 18/18 candidate checks and 19/19 stock-boundary checks in the recorded runs. The stock runtime remains ineligible for complete persistent session execution.

The isolated stdin negative control restores only the original NUL-device helper. Its handle-type assertion fails 0 passed / one failed, exit 101, reporting character device 2 instead of pipe 3; the unmodified suite passes. Required pull-request CI is green for 9c1cd468411da812c46a2cd092d91bdf6264bd58: https://github.com/T-Auto/dsh-ops/actions/runs/43476995227 . All required jobs passed, including Windows, Linux, both macOS architectures, Node floor, lint, size and tool trials.

Environment

Windows x64, Node 26.12.1, Rust 1.99.0 locally; CI uses the repository-pinned toolchain. Base: 3c276dc2afd9500207dca751923ac972a912f44d. Public DSH packages from the unchanged lockfile. No new dependencies, public schema changes, release or deployment.