fix: preserve Shell reference storage during failed handoff cleanup

packages/util/native-command/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/util/native-command/README.md
-README.md: ef9a066e38e584e592196ca4e6c80a266df135ad
-README.zh.md: 33ba66a2718bb5dbda2d5f346d656733eaeb4376
+README.md: ca820c4bc6c3ccdc9a54d4392176eb382ce5ae12
+README.zh.md: a948befc487c624d88426b27d15ecb0a91a8f813

packages/util/native-command/README.md

@@ -108,7 +108,7 @@ Linux association discovery and explicit launching require GIO. Missing native c
 
 These limits define when this runner is not the right tool. They are current package constraints, not a task backlog.
 
-- **No output bounding** — both streams buffer unbounded in memory; every current caller invokes small native tools whose output is a path or an error line. Adopt `dsh-output-retention` bounding before pointing this at commands with meaningful output volume.
+- Command output uses Node’s `execFile` buffer limit; oversized replies reject. Use the subprocess capability for streaming output.
 
 <a id="dev-note"></a>
 ### Dev Note

packages/util/native-command/README.zh.md

@@ -108,7 +108,7 @@ Linux 的关联查询和指定应用启动需要 GIO。缺少原生命令时查
 
 这些限制说明本运行器何时不是合适的工具。它们是当前包约束，不是任务积压。
 
-- **不做输出限量**——两路流在内存中无界缓冲；当前每个调用方只运行输出为一个路径或一行错误的小型原生工具。把它指向输出量可观的命令之前，先接入 `dsh-output-retention` 限量。
+- 命令输出受 Node 的 `execFile` 缓冲上限约束，超过上限时拒绝结果。流式输出由 subprocess 能力处理。
 
 <a id="dev-note"></a>
 ### 开发备注

packages/util/native-command/src/file-applications-windows.ts

@@ -99,8 +99,9 @@ public static class DshFileAssociations {
     } finally {
       SHSetInstanceExplorer(IntPtr.Zero);
       SHSetThreadRef(IntPtr.Zero);
-      if (reference != IntPtr.Zero) Marshal.Release(reference);
-      Marshal.FreeHGlobal(count);
+      int remaining = reference == IntPtr.Zero ? 0 : Marshal.Release(reference);
+      // An interrupted drain leaves its counter owned by the terminating helper process.
+      if (remaining == 0) Marshal.FreeHGlobal(count);
     }
   }