[ecochran76]

Native future wake registration saved qualified clock anchors but left due-time display empty and reported unavailable scheduling time. An unmonitored shared lifecycle root and missing control grants left a24-hour request retained without an active schedule.

This change projects original due/expiry dates without rebasing intent, distinguishes retention from durable-loop ownership, recovers pending timer state through no-dispatch native reconciliation, and exposes due/expiry through agent inventory. An optional private version2 host configuration gives attested native sessions list/cancel access to their own integrity-qualified wakes; peers, forged callers and root-wide actions remain denied. Existing explicit grants retain precedence.

Tracked repair: #360. Existing authority: HF-13 approved spec and HF-20 occurrence boundaries; plan0176. No new recurrence engine or changed catch-up/overlap defaults. Native scheduling already accepts delays beyond24hours; TTL follows due time.

Validation: public red/green cases cover24hours and3650days, late monitor arrival with one retained identity, pending timer recovery without submission, exact-scope inspection/cancel and self-service peer isolation. Affected60 tests pass; pinned Ruff, policy wiring and diff checks pass. Full CI required.

Live host repair so far: existing SoyLei intent retains its original key/prompt/target/policy/attempt count, due2026-10-27T01:21:37.949431Z and expiry24hours later. Lifecycle root now has a compatible supervisor loop. The only unrelated pending wake was independently proven expired; it is now retained failed with zero attempts, not revived. No business review, external provider inference, block mutation or native-server restart occurred. Current native daemon refuses selected-thread MCP reload; resident connection refresh remains a separate verification boundary.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}