[callumalpass]

Continuation of PR #112

PR #112 was automatically closed by a reference in #113's description, not merged. GitHub refuses reopening after the authorized branch rebase. This replacement uses exactly the same reviewed head 66268c84b1d4dfb385a40807ffb5a332edf1ab92, with no source or scope changes. At creation, no CI for this updated head had run; this PR started its one authorized normal CI. The description reference has been corrected.

Actual outcome

Merged as 95f6f36d5f0de87ec03be5a5045a84f25fc8229b at2026-10-20T00:00:02Z after all seven jobs in CI39343741746 passed at exact66268c8. Independent MERGED readback verified. Connect PR908 pins this actual merge and was subsequently merged as bfb541e97a8b1797eb070cb7b55feb064a03aee8 after required merge-group39347461990 passed. No deployment claim.

Fix

• Stop the derived-cache registry owning collection directory identity handles after the last authority closes. Windows capability handles intentionally deny delete sharing; a stale global key kept shutdown cleanup blocked until an unrelated acquisition pruned it.
• Replace strong identity keys with weak cache owners. Identity and temporary derived storage now have one lifetime. Live aliases still share storage; reacquisition after final release gets fresh storage. No sharing-flag relaxation, destructor callback, API or shutdown-budget change.
• Add deterministic last-owner release and cache-sharing/reacquisition regressions. The release test holds the registry mutex so unrelated acquisition cannot mask retention.

Qualification

• Runtime-source qualification at 067962247d0b52888df4b44dfcd5a6e394821d65; current head 66268c84b1d4dfb385a40807ffb5a332edf1ab92 is its patch-identical rebase onto actual policy-only Preserve legacy YAML fidelity with one scoped maintenance-notice exception #113 merge 7ff91c4fe828a08b74dfc79918cbca34a9b1638f. All files except deny.toml are identical to the qualified source. Old implementation RED (retained identity count1), fixed GREEN. Real Connect shutdown fd regression also RED→GREEN; existing Windows assertion unchanged.
• Local Rust via rcargo: workspace/all-target/all-feature clippy -D warnings, workspace/all-feature tests 801 passed / 4 existing ignored, docs -D warnings; fmt and architecture PASS. Spec fixtures pinned to eabae2143275a0619b02d564961fa74b8037185e. Live PostgreSQL not configured locally; mandatory CI PostgreSQL lane remains required.
• Exact final head 66268c8: rcargo deny check passed advisories/bans/licenses/sources. Runtime qualification above carries across byte-identical runtime files, not an unchanged-source reassurance run.
• Coordinator reviewed both upstream and dependent Connect diffs before merge; approved exact architecture adjustment +56 Rust lines (109806→109862), no new Rust files/public API, and tighter tempfile ownership count4→2.
• Connect will pin the independently verified actual upstream merge SHA after required CI succeeds; no branch-head/candidate substitution. No deployment or package publication.

CI status

• Run 39339612774 at exact 0679622: six jobs passed, including Windows/Linux/macOS, live PostgreSQL17, quality/features and packaging. Dependency policy failed on the unchanged dependency graph. Coordinator explicitly approved the single unmaintained-notice disposition separately in Preserve legacy YAML fidelity with one scoped maintenance-notice exception #113, now actually merged as 7ff91c4fe828a08b74dfc79918cbca34a9b1638f after all seven jobs passed. Parser/dependency/lockfile behavior remains untouched for migration fidelity. The authorized updated-head normal CI is required before this PR can merge; the dependent Connect pin remains held.