rushd: WS3/WS4 integration with Reporter prerequisites

[Sean Larkin (TheLarkInn)]

Purpose

Implementation for #5894, focused on WS3 (#5898) and WS4 (#5899), with the Reporter prerequisites from #5858.

Fixes #5898. Fixes #5899.

The existing rush and rushx defaults are unchanged. The separate rush-client and rushx-client binaries remain opt-in. This does not perform the Rush 6 cutover or close the full epic.

Implemented

• Native warm build/rebuild execution and real Rushx package scripts, with immutable request inputs, byte-preserving global streams, stdin credits/EOF, cancellation, queue controls, and fail-closed no-replay behavior.
• Generation-safe fingerprint reloads, bounded pre-execution restart retry, attested version-selected launchers, detached startup/crash handoff, idle shutdown, and native install/update results delivered before cleanup and successor startup.
• Generation-fenced structured graph commands, automatic warm-controller ownership, deterministic LRU/telemetry retention, observation-only daemon.watch, and live generation/reload/resource status without initializing a cold graph.
• Reporter integration and reviewed fixes for bootstrap control ownership, structured output capture, watch presentation, and reporter timer cleanup.

Reporter dependency stack

This branch preserves all original Reporter branch histories. Their changes remain in this diff until the existing PR stack lands; this integration PR is not a substitute for reviewing that stack.

Phase	Existing PR
R2A configuration	#5987
R2B frontend controls	#5989
R3A session sink	#5988
R3B shadow events	#5991
R3C parity	#5992
R4A telemetry/privacy	#5990
R5A operation adapter	#5996
R5B reporters	#5997
R6A bootstrap handoff	#5993
R7A Heft negotiation	#6000
R8A AI qualification	#5999
R10A demo/docs	#5998

R9 (#5982), R11 (#5984), and WS5 (#5900) remain subject to their actual review, compatibility, and release/ecosystem gates. No legacy-removal or default-selection gate is bypassed.

The Reporter stack has been restacked onto main@77abfe24 with guarded pushes and preserved backup refs. The scoped follow-up fixes are in #6019. Independent approval and dependency-ordered landing remain separate from this integration PR.

This PR is ready for review. Independent approval and the Reporter prerequisite landing order still apply before merge; the opt-in clients do not require the later default-selection cutover.

Windows correction batch

• Clients, launchers, and sessions use native physical filesystem identity consistently. Rushx separately preserves validated invocation spelling, including Windows 8.3 names and junctions, for child cwd, lifecycle environment, registration diagnostics, and pnpm-sync. Exact native output assertions are retained; output is never rewritten to manufacture parity.
• The shared LockFile Windows implementation now uses actual kernel exclusive sharing instead of assuming exclusive creation remains exclusive after opening. A dirty companion preserves interrupted-owner state across close/delete handoffs. This correction applies to all Windows LockFile consumers, not only the daemon; no native addon or dependency is added.
• Native rush purge retains its own active repository lock and Windows dirty companion while removing other temporary files. The regression verifies that purging does not delete live ownership or bypass the mutex.
• Native operation environments retain case-insensitive Windows Path values. Startup handoff treats sharing-denied ownership reads as unknown, not released, and retries only within the existing deadline. Owned child resources are joined before bounded Windows fixture cleanup.
• Native IPC fixtures launch a real Node IPC child instead of relying on cmd.exe to forward the descriptor. Graph CLI scenarios are separated, Windows cancellation exercises the actual CLI signal handler, and graph reload setup is separated from its assertions. Production startup deadlines and no-replay rules are unchanged.
• Native CLI test continuations are bound to their own fixtures and joined completely before deletion, including owned graph watches registered during cleanup. Initial daemon preparation is separated from reload/restart assertions; a timed-out callback cannot start work in, or remove, the next test's repository.
• Native Rushx registration lookup is unchanged unless the caller explicitly supplies a different invocation namespace. Embedded frontend tests capture and release their real parser locks after execution; production lock lifetimes and existing native snapshots are unchanged.
• Generated Git fixtures set core.autocrlf=false locally so host-global Windows settings do not produce LF-to-CRLF warnings. User Git settings and CI warnings-as-errors are unchanged. The real native graph suite uses an explicit 15-second integration budget after repeated setup timeouts, without changing assertions, cleanup limits, or production deadlines.
• Linux global requests wait for their captured detached group/session to settle before completion, not merely for signal delivery or leader stream closure. The bounded inspection uses procps-compatible ps --sid, never resends signals while waiting, and surfaces inspection/timeout failures.
• Remaining launcher fixtures join the actual daemon PIDs returned by start/restart before bounded Windows cleanup. Graph fixtures are removed only after successful host closure. Retention-only fixtures are isolated from accumulated Jest-worker RSS; production memory defaults and dedicated pressure tests are unchanged.

Validation

Hosted acceptance passed on exact head ba5753a9f146325deccb49e5aea485c6ba5aa3e2, run 34217211265.

Runtime	Platform	Result
Node 20	Ubuntu	PASS
Node 22	Ubuntu	PASS
Node 24	Ubuntu	PASS
Node 26	Ubuntu	PASS
Node 24	Windows	PASS
Node 26	Windows	PASS

Every job completed the full repository build/test run, package-manager integration, generated README verification, second-checkout update/build/test, and repeated build-cache verification. CodeQL and license/CLA checks also pass on this head.

Coverage includes actual CLI install/update, native coexistence, same-PID reloads, new-PID successors, startup-client death, ownership failures, graph-token races, real warm policies, ordinary CLI status, native Windows mutex/purge behavior, and exact Rushx parity through physical paths and 8.3 aliases.

All blocking Reporter qualification and performance gates remain enforced. Earlier failure logs and diagnostic observations are retained separately; the final green run used committed test budgets and the full workflow, without temporary diagnostic overrides or relaxed quality thresholds.

The opt-in registry integration also exercised a genuine published foreign-engine installation and runtime/protocol attestation. Incompatible installed engines are refused rather than relabeled as supported.

Deliberate safety boundaries

• Unsupported native configurations and incompatible published launchers retain explicit pre-execution native fallback; transport loss or possibly executed work is never replayed.
• Warm memory limits are best-effort sampled accounting, not a hard process-tree RSS ceiling. Active/protected work is not evicted.
• daemon.watch controls host project observation, not autonomous script execution or native Rush watch mode.
• Ambiguous pre-bind launcher failure retains its startup reservation instead of guessing that a PID can be killed or reclaimed.