[Haoming9527]

Refs #872. Stacked on #925; this slice does not close the full issue.

What was wrong

The shared Native/PTC file-call budget lived in a module-level map of hosts, outside the resident client's lifetime. Stopping or losing that client could leave pre-admission waiters pending until active callbacks released their permits.

The Windows concurrency CI also exposed an ACCESS_DENIED refusal. A deterministic held-handle fixture identified an unhandled sidecar deletion state: native STATUS_DELETE_PENDING was collapsed into Win32 error5, losing the distinction between contention and a real permission denial. The original CI log did not identify the failing internal stage; a separate 1,200-call stress diagnostic did not reproduce it.

The change

The existing ResidentClient now owns the same FIFO through admitFileCall: two active and eight waiting calls per session. Waiting callbacks resolve current authority only after admission, before any native request exists. Stop/failure rejects waiting callbacks immediately; accepted calls and result-cache cleanup retain their existing joined lifecycle. Native execution queues are unchanged.

The shared fixtures now declare their owning client explicitly. Windows lock acquisition uses a held-directory, no-follow native opener to preserve exactly STATUS_DELETE_PENDING as error303 and then REVISION_CONFLICT. True access denial remains ACCESS_DENIED; inherited ACLs, ordinary read/write rights, sharing and binding checks are retained. There are no added retries or DELETE rights.

Bilingual rationale and changelog are updated. No dependency, version, model schema, prompt, runtime-pin or platform-policy changes.

Validation

Original admission checks on Windows x64, existing worker SHA256 024d5e80b9befe77dce3b3ad4bf6c2d4d40e236047054acc79dd9f7196192b2c:

• Build and typecheck passed. Size gate: 942 files, all at or below 1,000 lines.
• Affected verification: 129 named checks across 15 suites passed, plus the original PTC end-to-end suite; zero skipped. This covers FIFO/overflow/cancellation, current authority after waiting, real shared Native/PTC routing, confinement, result paging, cleanup, provider isolation and public process ownership.
• The permission matrix passed 15/15 in 129.90s with an explicit diagnostic 300s outer allowance. Its prior default-120s run timed out after a 79.48s legacy runtime pre-stage; that failure remains recorded. The repository timeout is unchanged. This is not a claim that the local default full gate passed.
• Before implementation, the three new lifecycle checks failed; the existing 21 client checks passed. Removing only the two client budget-close hooks from an isolated compiled copy produced two failures and one pass: queued stop/failure waiters stayed pending. The positive client suite passed 24/24.
• Initial fixture failures were retained separately: tool-sandbox symlink denial, preflight mocks lacking explicit providers, an unset Bash fixture, a worker override conflicting with the PTC package-resolution assertion, and an unavailable dependency junction in the negative-control setup. Corrected inputs were verified; no production retry or fallback was added.

The first PR run 43512919665 failed its minimum-Node job in three additional preflight-only fixtures that lacked an owning client (wsl-readonly, read-files-host, safety-atomicity). The append-only correction declares those owners and keeps the missing-workingDirectory regression focused on its intended refusal. All four corrected suites passed 20 checks, zero skipped; production code did not change.

The second PR run 43513959592, head ace51a2d69e96f1e1198c8aab773ae40d77ff054, failed its Windows functional job: the six-writer linux-protocol check returned ACCESS_DENIED once. Windows recorded 261 passed suites, one failed, four skipped; all eight other underlying CI jobs passed. The subsequent sidecar fix does not claim that the unlabelled CI interleaving was fully traced.

Focused sidecar validation at b3f2f4f58530eb09264e35e220a6a26135c4ddb8, explicitly using CI-pinned Rust1.97.1:

• cargo +1.97.1 build --locked --manifest-path native/Cargo.toml --bin dsh-ops-worker: passed.
• cargo +1.97.1 test --locked --manifest-path native/Cargo.toml -p ops-files -p dsh-ops-windows-metadata: 24 unit tests passed, zero failed/ignored.
• cargo +1.97.1 clippy --locked --manifest-path native/Cargo.toml -p ops-files -p dsh-ops-windows-metadata --all-targets -- -D warnings: passed. Format/diff checks passed; size gate passed all944 tracked code files.
• Old worker with new deterministic Windows security regression: five checks passed, one failed specifically on ACCESS_DENIED instead of REVISION_CONFLICT. Real sidecar DACL denial still passed. Initial fixture setup emitted PowerShell module progress to stderr; that cosmetic progress was disabled before this red control.
• Fixed worker, node test/run.mjs windows-security lock-sidecar linux-protocol replace-concurrency: 16 checks across four suites passed, zero skipped. The held delete-pending case leaves target bytes unchanged and a new call succeeds after the holder closes; a real WriteData DACL denial remains ACCESS_DENIED with unchanged permissions.

Current pull_request CI: run43551459661, exact head b3f2f4f58530eb09264e35e220a6a26135c4ddb8; completed successfully. All nine underlying jobs and aggregate CI required passed. Windows functional gate: 262 suites passed, four platform skips in299s; linux-protocol4/4, replace-concurrency2/2 and windows-security6/6. No performance claim.

Environment

Windows x64, Node 26.12.1, locked development dependencies. Base: public PR #925 head 80dbcc8535271f7da460fe913d68783fdd6f163e. The matching worker was staged with the repository tool and verified by hash. Validation used isolated test homes and the existing pinned legacy Bash fixture. No merge or release.