[Haoming9527]

Refs #872. Stacked on #919 (work/872-private-channel-spill, base 55d04951d479ff584ddee96c38f2fce05b0aa134). This connects production fresh execution; persistent publication, remaining cleanup transport and final acceptance remain open.

What was wrong

Fresh Bash still launched through a per-call public subprocess even when the owning kernel supported complete native task output. Moving just process creation would leave approval, environment, confinement, Jobs handoff and the Native/PTC result contracts disconnected from current session authority.

The change

The common root mounts the fresh task provider only when the actual kernel advertises both task-v1 and task-spill-v1. Each native queue head rechecks the exact current Agent/Session, publication, standing authority, environment, selected runtime and public confinement. A widened one-call grant cannot survive changed standing authority; active authority changes cancel only admitted work. Initial approval still precedes explicit background registration.

Use the existing argument validation, directory resolution, script operand, JSON digest, renderer, public Jobs and retention contracts. Scripts remain file operands opened by the confined Bash. Background publication and timeout promotion retain the same physical task and public Job ID. Preserve environment precedence, tombstones and Electron runner adaptation. Native error/effect facts remain authoritative during diagnostic classification.

The actual-process probe now mounts the ordinary package root, with no internal task-factory injection or capability override. Explicit authority fixtures were added where schema/publication tests previously supplied incomplete Agent-shaped objects. Bilingual docs and changelog included; no new dependency, runtime pin or model-facing schema change.

Validation

• Build, typecheck and git diff --check: passed. Source-size gate: 925 files, all at or below 1,000 lines.
• Final focused regression inventory: 263 distinct checks across 25 suites passed. Existing POSIX-unavailable fixture notices remain explicit. These cover policy/grant/environment changes, admission ownership, publication withdrawal, Jobs handoff, spill/retention, original host contracts and root composition.
• Production root Native/PTC probe: 7/7 passed, workspace-write/partial public confinement, including script paths with spaces/Unicode, approval refusal before effects, explicit background, same-task promotion, native spill and existing paged recovery, and provider withdrawal. 6 native task requests, 1 kernel and 5 PTC public process spawns, zero public per-call Bash spawns; kernel PID24844 gone after joined cleanup.
• Worker SHA-256 51ec139dc8e7dbb9fe7881ee71aa25c691e070bfeb122f50e7520a6bfe7383e6; stock fresh Bash 7ec3ec04ce91bae64c23d7150e6b16574e9d91df8fcf0df997006e2b37bf2f1e; report SHA-256 5a529dbc9032fd422c65c69ff8c9d74ec057e7e49355b9b6f1d1b3edd4634993.
• Earlier setup and assertion failures are retained: omitted explicit worker, unstaged complete payload, incomplete schema/publication authority fixtures, and expecting completed for an intentionally paged partial read. Correcting those fixtures did not change production TypeScript or budgets. The original internal-seam proof remains documented separately.
• CI fixture follow-up 5a93fc2e: 42/42 checks across 6 suites passed, 0 skipped on Windows against this PR's own release worker. Command: node test/run.mjs modes.test.mjs bundle-startup native-guidance permissions.test resident-fresh-publication with DSH_OPS_TEST_JOBS=1, DSH_OPS_SUITE_TIMEOUT_MS=300000, explicit release-worker path and verified legacy Bash fixture. Includes all 15 permission checks, 12 modes checks, 4 bundle checks, 2 Native guidance checks, 5 missing-authority/provider-withdrawal checks and 4 release archive checks. Size gate still passes all 925 files; git diff --check passes.
• The first CI run exposed incomplete fixture authority services on Windows and a Native-guidance fixture that overwrote one of two gate subscribers on macOS. The four-file test correction supplies live Agent/Session lookup plus shell environment, mounts the real fresh provider for standalone rows, and waits for actual publication/subscription readiness. Production behavior, capability gates, failure assertions and command budgets are unchanged. Local pre-fix bundle/modes failures and a 120s permission-suite watchdog failure are retained; the successful serial permission run took 121.99s, including 57.31s cold legacy staging. The explicit 300s allowance changes only this local whole-suite invocation.
• Follow-up release worker SHA-256: b3a0e13e71a4b06deac63dba41c352319e93494fac46b37aae0e9f205777a380 (built from the exact PR920 native source).
• Cross-platform validation #1045 for 5a93fc2e exposed a separate Windows Rust fixture collision before reaching JavaScript suites: simultaneous Fixture::new() calls used the same PID and wall-clock timestamp (AlreadyExists, OS183). Linux and Node-floor jobs passed. Follow-up f10c54d5 adds a per-process atomic suffix and a deterministic same-clock concurrent uniqueness test. Sibling native process/session fixtures were inspected; no production change was needed.
• After that correction, cargo test --workspace --locked --manifest-path native/Cargo.toml: 731 passed, 0 failed, 6 explicit ignores (five child-fixture entry points and the UNC prerequisite). The previously failing raw-tail/stdin-EOF/exit259 lifecycle case passes. cargo fmt --check and git diff --check pass. This is a source correction followed by a new run, not a retry of the failed job.
• Current pull_request / aggregate CI required: Cross-platform validation #1048 passed all 10 jobs at exact head f10c54d521d8f084bc94d605d0b4b9e574a2e02a: Windows x64, Linux x64, macOS x64/ARM64, Node-floor, Rust/workflow lint, source-size, tools trial and aggregate. Windows full suite: 255 passed, 4 explicit skips; permission 15/15, bundle 4/4, modes 12/12 and Native guidance 2/2 all passed. macOS ARM64 full suite: 253 passed, 6 explicit skips, including Native guidance 2/2. Prior failed runs remain recorded above.

Environment

Windows x64, Node26.12.1, Rust1.99.0 locally; locked public DSH0.2.2-rc.1 services and official Jobs/shell-environment plugins. Stack starts at main e724444416fed01eb1f75916ec556c0a286e73f9. Stock Bash is used only for fresh execution; this does not qualify its persistent async-output behavior. No merge, release or deployment.