[Haoming9527]

Refs #872. Stacked on #917 (work/872-native-raw-spill, base 691ec977dc832df9d182524ebbd0109866f94734). This is the task-output integration slice; #872 remains open.

What was wrong

The native task queue retained bounded tails but did not configure the shared raw-spill store or hand complete native files to the existing retention ledger. That prevented the production fresh executor from requiring recoverable output parity. An unconfirmed capture join also needed to seal its owner before publishing the failure.

The change

Configure the allocation-only store before Windows kernel readiness and advertise task-spill-v1 alongside task-v1. Task readers retain the 64,000-byte tail, expose complete live prefixes up to 64 MiB, and withdraw the full path on storage/cap failure. Final settlement records only EOF-confirmed, error-free, sealed native streams after confirmed cleanup, with the actual kernel PID and captured Session ID, then notifies the existing retention scheduler. The original host execution path shares the settlement helper.

Bound capture joins and retain poisoned ranges. Seal the owner before terminal publication and trigger independent transport shutdown even if publishing fails. The public host retires the owned kernel; late output cannot restore a successful cleanup claim.

The actual-process CI probe covers memory boundary, full stdout/stderr recovery through existing file permissions, live Jobs metadata, cap withdrawal, cancellation, retention and kernel crash cleanup. Bilingual docs and changelog are included. No dependency, version, model-facing schema or prompt change. Production fresh activation and persistent sessions remain subsequent integration work.

Validation

• cargo test --locked --manifest-path native/Cargo.toml --bin dsh-ops-worker task::: 11 passed, 0 failed, 1 ignored; the ignored child fixture is explicitly invoked by its parent.
• cargo clippy --locked --manifest-path native/Cargo.toml --workspace --all-targets -- -D warnings, cargo fmt --all --check, worker build and npm run build: passed.
• Settlement/execution/ledger/retention: 39 checks across 4 suites passed. Two pre-existing POSIX-unavailable subchecks remain explicitly reported on Windows.
• Original shell execution/task channel/Jobs contracts: 26 checks across 3 suites passed.
• Actual task-spill probe: 7/7 passed, workspace-write/partial confinement; kernel PID 23044 exited and no observed PID survived before emergency cleanup. Worker SHA-256 51ec139dc8e7dbb9fe7881ee71aa25c691e070bfeb122f50e7520a6bfe7383e6; retained report SHA-256 29a0f9ac4320a09f66b719302c3024f4069a954de64758acc817e0f02d2938dc.
• Removing only the owner seal: 0 passed / 2 failed; restoring it: 2 passed / 0 failed. Removing only host settlement in a separate compiled copy: 7 passed / 3 expected failures; unchanged implementation passed all 10. The first negative-copy setup hit an outer-sandbox junction EPERM before tests; that setup failure was retained, then ordinary host setup ran the single negative control. Product confinement was unchanged.
• Workflow checks: 117 passed. Source size: 915 files, all at or below 1,000 lines. git diff --check: passed.
• This PR's own pull_request CI run: https://github.com/T-Auto/dsh-ops/actions/runs/43490453643 — passed, including aggregate CI required, on final head 454123e090636ae4a1ec861fa4faa6298e331e05.

Environment

Windows x64, Node v26.12.1, Rust 1.99.0; local source worktree. Common stack originates from main e724444416fed01eb1f75916ec556c0a286e73f9. The actual probe uses public host subprocess/sandbox/Jobs services with the internal task adapter; it does not substitute for the production fresh authority bridge or accepted persistent-runtime verification. No release or runtime pin was changed.