[loverustfs]

Change

Cold availability failures return Missing without mutating the hot store. Retention preserves credits on errors, continues fair progress for healthy jobs and bounds metadata before accepting work. Permanent failure, retry exhaustion and full failed-job queues have explicit outcomes. Legacy manifests cannot produce hits and orphan deletion is not speculative.

This branch includes the corrected bounded TCP admission and shard client from #10–#11. Cold paths remain optional and outside the hot path; tests use the default mock object store.

Validation

Run the retained CPU gate with a fresh evidence directory:

python3 scripts/ci/vm_regression.py --profile cpu --offline --output artifacts/merge-review-cpu

Fetch locked dependencies once before the offline run. The runner checks formatting, default/all-feature Clippy, workspace/doc tests, optional-feature refusal contracts and CPU demos; it writes results.json, environment.json, summary.md, JUnit and raw logs. GitHub CI runs Linux x86_64, native aarch64 and aarch64 qemu-user checks and uploads x86_64 regression evidence.

Boundaries

GCK1/GCKR and CacheIdentity remain unchanged. Missing, failed or unverified blocks require recomputation. No hot erasure coding, durability replicas, linked accelerator libraries or product performance samples are added. TCP remains a trusted-fabric plaintext transport; the bearer fingerprint does not provide mTLS.

Real RDMA/NIXL, GDS, BF3/DOCA/SPDK, vLLM export/import and live RustFS remain NOT_RUN_HARDWARE. GPU/model execution remains NOT_RUN_BUDGET; an approved model/license campaign remains NOT_RUN_LICENSE. TCO_UNKNOWN, go_gate=NOT_EVALUATED, Mooncake NOT_LINKED and NOT_A_PERFORMANCE_RESULT remain.