[Haoming9527]

Refs #872. Stacked on #920 (work/872-resident-fresh-bridge).

What was wrong

Persistent sessions retained bounded memory output but did not connect their authenticated stdout/stderr channels to the resident task spill store or the settled-file retention ledger. A session output larger than 128 KiB therefore lacked the full-file recovery available to fresh tasks.

The change

• Clone the kernel's existing allocation-only store into both task and shell managers before readiness; advertise shell-spill-v1 only after this wiring.
• Carry correlated native spill metadata, validate the actual handshake PID, and collect both terminal streams before releasing their record. Refuse unsealed or changing terminal metadata; never expose a recovery path for raw capture errors or unknown cleanup.
• Record sealed streams in the existing ledger under the exact calling Session. Preserve the 128 KiB memory prefix, 64 MiB complete-file cap, private/no-follow origin and existing file-read/write authority.
• Add bilingual documentation, focused regressions and a real public-host CI probe explicitly restricted to stock foreground commands.

This slice adds 70 production lines; the complete diff is 18 files, +509/-11 including tests, fixtures and documentation. No dependency, version, runtime pin or model-facing schema changes. Public session activation still requires a qualified runtime in addition to shell-v1 and shell-spill-v1; stock asynchronous output remains unqualified. POSIX shell ownership remains unsupported.

Validation

All local checks below completed on the reviewed implementation; the build and 50 host checks were repeated after stacking onto #920.

Command / proof	Actual result
npm run build	Passed
node test/run.mjs resident-shell-channel resident-shell-admission resident-shell-output	3 suites, 50 checks passed; 0 failed/skipped
cargo test --locked --manifest-path native/Cargo.toml --bin dsh-ops-worker	22 passed, 0 failed, 1 ignored owned-child fixture explicitly invoked by lifecycle tests
cargo clippy --workspace --all-targets --locked --manifest-path native/Cargo.toml -- -D warnings	Passed
cargo fmt --check --manifest-path native/Cargo.toml --all and git diff --check	Passed
node scripts/check-workflows.mjs	117 checks passed
node scripts/check-file-size.mjs	920 code files passed; longest 995 lines
node bench/probes/probe-872-session-spill.mjs <worker> <candidate> <stock-support> <report>	9 passed, 0 failed/skipped; cleanup confirmed, 0 survivors
Same session probe with stock executable/support and --stock-foreground	9 passed, 0 failed/skipped; cleanup confirmed, 0 survivors
node bench/probes/probe-872-shell-started.mjs <example> <stock> <stock>	3 passed: cancel, close and deadline stop the owned shell while physical started delivery is held

The candidate proof uses local executable SHA-256 7c4332044ac5fd1b789f30b29c155a62f12f07f8dd3495244bda3ce4e0e84664. Its external background commands followed by wait recover exact 1 MiB binary stdout and stderr in all three sandbox modes. It also proves retained shell state, one directory shared with fresh tasks, exact Session ledger reload, file recovery/write refusal, cap withdrawal, retention and kernel loss with an unsealed live stream. Tested worker SHA-256: 9b25fceacb73ab1abe53b64b291b89d8ee8896cb9d8df6cfa7a1983f993715c0.

The first candidate probe stopped after five passing checks because its local call variable shadowed the fixture function. Its failed report is retained as resident-probe-temp/session-spill-candidate-fixture-failure.json; teardown confirmed zero survivors. The fixture was corrected, then the complete nine-check run passed. An initial Clippy run identified the path-included cancellation example's unused new configuration method; that example now initializes the same allocation-only store, and Clippy plus the actual three-case cancellation proof pass. These failures are not reported as production regressions or passing runs.

Final local evidence: resident-probe-temp/session-spill-{candidate,stock}.json, and session-spill-{stacked-host,native,started,clippy,workflows}.log. The full npm run verify release gate was not run locally for this slice; the latest PR-triggered full cross-platform gate passed as recorded below.

Retained CI history: Cross-platform validation 43493997529 failed on the incomplete Windows permission/startup/mode authority fixtures inherited from #920. The base correction adds real fresh-provider ownership and readiness to those fixtures, fixes the Native-guidance gate's overwritten subscriber, and adds deterministic unique names for parallel native task fixtures after a separate Windows timestamp collision. These are source corrections, not blind reruns.

Latest exact-head validation: Cross-platform validation 43498759422 passed all 10 jobs, including aggregate CI required, at 6649c02d6bad923834f0f4cc35ece8696db9687a. Windows x64, Linux x64, macOS x64/ARM64, Node-floor, Rust/workflow lint, source-size and tools trial are green. Windows full suite: 256 passed, 4 explicit skips; all corrected permission (15), bundle (4), modes (12) and Native-guidance (2) checks passed.

Environment

Windows x64, Node.js 26.12.1, Cargo/Rust 1.99.0. Locked dependencies installed with npm ci --ignore-scripts. Current base: #920 commit f10c54d521d8f084bc94d605d0b4b9e574a2e02a; head 6649c02d6bad923834f0f4cc35ece8696db9687a. The earlier local-probe hashes above retain their original meaning. Real permission/ownership probes used the normal host context and exact public sandbox confinement. The local backport archive remains unpublished and shipped runtime pins are unchanged.