[Haoming9527]

Refs #872. Stacked on #926.

What was wrong

Caller cancellation waits for session-shell cleanup, then the public tools pipeline returns ABORTED. That replacement discarded the typed shell-reset receipt. The caller learned about lost cwd, exports, functions and options only on a later call. Public PTC run_code also replaces the nested result, so preserving a Native-only error would not resolve both projections.

The change

After a cancelled session call settles with shellState: reset and cleanupConfirmed: true, defer one dsh-ops:shell-reset context through the existing public ToolRunContext.deferContext API. It carries the call ID and truthful none or unknown effect state. Both public executors retain this fact in the result's additionalContexts while the cancelled tool card remains ABORTED.

Pre-dispatch cancellation, unchanged or unknown state, and unconfirmed cleanup emit no confirmed-reset notice. Existing fresh execution, next-call state-loss reporting and the host's context inbox remain unchanged. The slice adds no retained-result map, dependency, host patch, runtime pin or native code. Bilingual session documentation and the changelog explain the result/context distinction.

Validation

• Reverted-behavior baseline: 15 checks passed and the new notice assertion failed because zero contexts were returned instead of one; retained reset-notice-unit-red.log.

• After rebasing onto 301bc64e: npm run build passed; node test/run.mjs persistent-mode session-reset-notice publication-boundary passed 20 checks in 3 suites, 0 failures, 0 skips.

• Public Native and actual public Node PTC boundary tests verify joined settlement, ABORTED, exact call correlation, confirmed resets with both effect states, and the negative cases above.

• Earlier qualified production-root probe node bench/probes/probe-872-session-reset.mjs --worker <fd01 worker> --bash <qualified candidate> --shell-env <public shell-env> --controller <public jobs> --report <path> passed 2/2 actual Native/PTC checks, with 0 cleanup errors: the target shell was gone before the result, sibling state survived, and the next target call reported state loss. No admission injection was used.

• Earlier actual report reset-notice-actual-qualified-final.json SHA-256: 945108e900a4d73033a86466df7d068661a6b2609074ff3d4c664d6a8e05a876. Worker: fd01f8f238325f6120becfe0ee1c6bbd9d64d6e385d9306f1f42ace2e0be0542; candidate Niubash: 7c4332044ac5fd1b789f30b29c155a62f12f07f8dd3495244bda3ce4e0e84664.

• The first actual probe passed Native but exposed a fixture-only duplicate PTC executor registration; its failure report was retained, the fixture now selects each executor once, and both final cases passed. An initial staging CLI-argument error was retained and corrected by invoking the official staging script directly.

• node scripts/check-file-size.mjs: 946 tracked code files within limit. git diff --check passed.

• Integrated unpublished candidate Windows gate at clean head 511f9920044c1aa38d7ca8443e1a6e26f7bc61c5: 13/13 steps passed, 739 Rust tests passed with 8 explicit helper ignores, 263 suites passed with 4 permitted skips and 0 failures, all 92 manifest checks passed. Both workspace tests and the release build used pinned Rust 1.97.1. Release, staged and packed worker SHA-256: 36f2a4c47abdf54c82569703d29c8887d6f40a7a22ab0d05be70f24eb06b7c4a. Gate receipt reset-runtime-adoption-511f992-full-windows-gate.json: 215a18bc05eddbe4f89e5be6fbad7ebc5159f71abc94ec1da2c1641a9d3d2ac0. This records the integrated gate; long-running actual CLI qualification and performance acceptance remain separate.

• Previous-head CI required pull-request run: 43514027800, event pull_request, passed on head 38cf9812. All ten jobs are green: Windows x64, Linux x64, macOS ARM64/x64, Node compatibility, Rust lint, source size, workflow lint, tools trial and the aggregate check. The Windows job passed 263 suites, 4 permitted skips, 0 failures in 352 seconds; its full gate and all 92 manifest checks passed.

• Current-head CI required pull-request run: 43551581185, event pull_request, passed on head c2e046b5. All ten jobs passed, including Windows x64, Linux x64, macOS ARM64/x64, Node compatibility, Rust lint, source size, workflow lint, tools trial and CI required. The Windows job passed 263 suites, 4 permitted skips, 0 failures in 343 seconds, the full gate, all 92 manifest checks and the subsequent Windows ownership/spill checks. Its security suite passed all 6 checks, including delete-pending contention and genuine DACL denial; protocol and concurrent replacement checks also passed. The previous-head results above are historical.

Environment

Windows x64, Node 26.12.1, pinned public DSH host packages, local locked install. Slice head c2e046b519f7a1b44d228728da75132225fa1416, after a normal merge of the reviewed Windows update-lock fix b3f2f4f58530eb09264e35e220a6a26135c4ddb8; production reset changes remain identical to the validated 36462c51 slice. The real-shell probe used an isolated unpublished qualification checkout with the already reviewed candidate payload staged offline. Stock Niubash remains ineligible for full persistent-session output fidelity. No runtime asset or adoption pin is published by this PR.