feat(zeroshot-rust): host isolated native clusters and bounded recovery in the local daemon

[tomdps]

Parent

• feat(zeroshot-rust): add authenticated local-daemon discovery and loopback host #692 — feat(zeroshot-rust): add the authenticated multi-cluster local daemon

Execution

AFK. Start only after every issue in Blocked by is merged, required CI is green for the resulting dev SHA, and the worktree is created from a freshly fetched origin/dev.

Outcome

Host isolated native clusters and bounded restart recovery in one authenticated local daemon after the production backend is certified.

Authoritative contracts/current state

#692 is narrowed to discovery/authenticated loopback hosting. #774 composes the production backend and #693 certifies it; #678 supplies durable watch and concrete drivers/credentials supply standalone execution.

Owned scope

• Maintain one bounded LedgerStore profile catalog with paginated cluster/create, cluster/open, and cluster/list product-control methods; route graph/lifecycle methods through one-cluster dispatchers.
• Compose one shared fair scheduler/runtime/driver-pool lifetime with per-cluster ledger/coordinator/backend isolation and route-specific authorization.
• Fold persisted clusters at startup and reconcile active dispatch only through ExecutionRuntime::inspect; keep inactive clusters lazy and reject ambiguous/corrupt catalog entries.
• Implement the five-minute idle-exit predicate and graceful release of listener, stores, drivers, runtime, and scheduler without deleting cluster history.

Acceptance criteria

• Multi-cluster create/open/list, restart reconciliation, authorization isolation, capacity fairness, and idle exit pass deterministic loopback tests.
• No PID, locator, process, or provider session is treated as durable lifecycle truth.
• One cluster failure/cancellation/slow watcher cannot block or corrupt another.
• No export route, CLI behavior, Node fallback, global event bus, or second ledger is introduced.

Verification

cargo test -p zeroshot-rust --test daemon_host
cargo test -p zeroshot-rust --test daemon_recovery
cargo test -p zeroshot-rust --test daemon_idle_exit
cargo test -p zeroshot-rust --test architecture
npm run rust:check
npm run protocol:check
npm run typecheck
npm run lint
npm run test:unit
opcore check --changed

Every named focused target is an issue-owned deliverable and must execute non-zero tests before the common gates.

Non-goals

• Discovery/auth listener contract owned by feat(zeroshot-rust): add authenticated local-daemon discovery and loopback host #692.
• Product export or CLI commands.
• Hosted cloud control plane, remote workers, or alternate persistence.

Blocked by

• feat(zeroshot-rust): add authenticated local-daemon discovery and loopback host #692 — feat(zeroshot-rust): add the authenticated multi-cluster local daemon
• feat(zeroshot-rust): compose the production NativeBackend factory #774 — feat(zeroshot-rust): compose the production NativeBackend factory
• feat(zeroshot-rust): project the native ledger into durable protocol watch #678 — feat(zeroshot-rust): implement ledger-backed durable watch and reconnect
• feat(zeroshot-rust): add the generic CLI worker driver #672 — feat(zeroshot-rust): add the generic CLI worker driver
• feat(zeroshot-rust): add the pooled ACP worker driver #673 — feat(zeroshot-rust): add the pooled ACP worker driver
• feat(zeroshot-rust): add the trusted-profile Gateway worker driver #674 — feat(zeroshot-rust): add the trusted-profile Gateway worker driver
• feat(zeroshot-rust): resolve native credentials into ephemeral capabilities #770 — feat(zeroshot-rust): resolve native credentials into ephemeral capabilities
• feat(zeroshot-rust): project safe errors across product command and daemon boundaries #767 — feat(zeroshot-rust): project safe errors across product command and daemon boundaries

Unblocks

• feat(zeroshot-rust): build canonical bounded product exports #688 — feat(zeroshot-rust): persist execution evidence and add deterministic export
• feat(zeroshot-rust): add native daemon and cluster management CLI commands #765 — feat(zeroshot-rust): add native daemon and cluster management CLI commands
• test(zeroshot-rust): add durable-watch and daemon recovery matrix #757 — test(zeroshot-rust): add durable-watch and daemon recovery matrix