[Haoming9527]

Refs #872. Stacked on #921; this is the public session integration slice.

What was wrong

The resident session kernel and spill transport were not reachable through the ordinary Bash tool definition. Native and PTC need the same explicit session selector while preserving the existing fresh command and Jobs path. A retained tool definition must also refuse a different Agent before it can enqueue work.

The change

The composition layer selects built-in/custom runtimes and supplies that selection to the generic session admission owner. The package root owns this provider alongside the existing fresh provider. Eligible runtimes expose optional execution: "fresh" | "session"; omitted execution preserves fresh behavior. Session calls preserve cwd, exports, functions and options, use the existing native FIFO and current authority checks, and return explicit shell state, state loss and cleanup results. Background Jobs and script files remain fresh execution, with actionable refusal for incompatible session arguments.

Publication requires both native session capabilities and an accepted complete runtime inventory. The accepted set remains empty for the currently shipped stock runtime, whose asynchronous output ownership defect is reproduced and documented. There is no user override or injected production admission path. This slice does not enable the unqualified runtime or complete #872.

Native and PTC share typed output settlement. Only a sealed spillPath reaches the public result; native ownership metadata stays internal. Truncated streams lacking recovery paths are identified explicitly. The publishing Agent must match at submission and queued admission. Agent/provider disposal joins the existing owner cleanup without replay or fallback. English/Chinese docs and changelog describe the contracts and remaining runtime qualification.

Validation

• npm run build, probe syntax and git diff --check: passed. Source-size gate: 933 files, all at or below the unchanged 1,000-line limit.
• 92 checks across six focused suites passed: persistent-mode 14, persistent-admission 10, resident-shell-admission 34, resident-shell-channel 15, resident-fresh-host 14, resident-fresh-publication 5. The first integrated run exposed a fixture kernel missing task.capabilities; correcting that fixture preserved the production capability gate. Its failed log is retained.
• Exact-Agent negative control: removing only the publishing-Agent equality in an isolated compiled copy produces 13 passed, 1 failed; the unchanged implementation passes all 14 publication checks. The negative report is resident-probe-temp/session-agent-negative-MjKeCe/report.json.
• Model-facing UTF-8 measurements with the same Windows/background fixture: optional session publication adds 476 description bytes, 414 parameter-schema bytes and 631 guidance bytes. Its typed output schema adds 2,088 bytes. Fresh-only publication keeps its existing shape. Receipt: resident-probe-temp/session-public-schema-bytes.json.
• Normal-root candidate qualification: 9/9 passed, cleanup confirmed and kernel gone. The isolated build differs from d0aa842c only in its complete candidate manifest and accepted inventory digest; it uses normal root publication without an internal admission override. All three sandbox modes recovered complete waited-background stdout/stderr. Worker 9b25fcea…, candidate archive d446bf83…, report SHA-256 4fc90c521b1850aa88c800b5e006ea10cf1bae8b828372f6e8f924a6f245b063; the exact source/payload receipt is retained. The candidate remains unpublished and this PR keeps the shipped pin/empty accepted set unchanged. Historical internal-seam proof is labeled separately; no performance claim.
• Four actual DSH CLI instances sharing home/workspace: passed, 54 recorded events, 41 observed process identities gone before emergency cleanup, zero cleanup errors. Distinct persistent state, targeted public cancellation with sibling survival, explicit Jobs, control disconnect, kernel crash, normal SDK shutdown and forced host death are covered. Report SHA-256 c7488c1ddecb4849e5ff8d5df740ae4afdbe4e6f43935614b8a0546e26aa4041. The first failed fixture expected the inner cancellation value; the corrected check uses DSH's actual ABORTED envelope, verifies child exit and checks stateLost: "shell-reset" on the next call. The host envelope's lack of immediate typed shell state is documented. This short run does not repeat the separate five-minute fresh-task proof.
• The first full CI exposed a forbidden preset import in the generic execution layer. Moving the unchanged selection factory to product composition passed the unchanged architecture check plus publication/admission regressions: 31 checks across four suites, zero skips. The failed run is retained; no gate was weakened.
• Retained architecture failure: Cross-platform validation 43498780735 failed before the composition-layer correction described above. Base fixture corrections passed 42 host checks and 731 Rust checks (0 failures, 6 explicit fixture/platform ignores).
• Latest exact-head pull_request / aggregate CI required: Cross-platform validation 43500151511 passed all 10 jobs at 3fd7253d10ee3fba919c726e55ce30a01552753c. Windows x64, Linux x64, macOS x64/ARM64, Node-floor, Rust/workflow lint, source-size and tools trial are green. Windows full suite: 258 passed, 4 explicit skips; macOS x64: 256 passed, 6 explicit skips. Both logs confirm the unchanged publication-boundary checks pass.

Environment

Windows x64, Node26.12.1, Rust1.99.0 locally, locked DSH0.2.2-rc.1 public services. Base #921 6649c02d6bad923834f0f4cc35ece8696db9687a; original stack main e724444416fed01eb1f75916ec556c0a286e73f9. No new dependency, package-version change, release, merge or deployment. Full feature acceptance still requires runtime adoption, transport cleanup and final cross-platform measurements.