[joelteply]

Persistent citizens need a supported development maintenance window that durably drains their work, excludes managed restarts, and restores serving even when observation fails. Add Windows continuum maintenance <1..300 seconds> and explicit journal recovery by composing existing shutdown and SchedulerCustody owners. No cache deletion, pagefile settings or container migration is performed.

Move shared serving identity, owned-exit and one-shot launch checks from container maintenance into maintenance_serving; migrate both callers. Restore generic partial scheduler-disable failures while retaining legacy recovery semantics. Add parsing, lifecycle failure-matrix and partial-disable regressions to existing Windows CI coverage.

Validation: diff check clean; independent source review requested. Native compilation/tests run in CI because this node is serving. No live maintenance or recovered-capacity claim. Zero OS contraction is a bounded result, and interrupted recovery restores intent without claiming a lost pre-crash model comparison.

Card b7053790-c62b-45a6-a47a-5027f473e086. Detailed shared-owner/acceptance receipt: docs/planning/BOUNDED-SERVING-MAINTENANCE.md.

[joelteply]

Independent source review by Codex retirement_review: APPROVE source at aa7b470, subject to required CI.

Both requested corrections are present. The shared launch diagnostic no longer falsely claims a retained journal after plain restoration. Production disable_for now passes its actual mutation result and held custody through settle_disable; the focused fixture covers generic restoration, legacy preservation without automatic restoration, combined disable/restoration errors, and successful custody transfer. These are injected policy/failure-path checks, not evidence of real Windows task mutation.

The bounded foreground window reuses scheduler custody, durable shutdown, and the extracted serving-identity checks; ordinary observation/drain errors reach restoration. Restoring scheduler intent retires the plain journal before restart, so competing deployment can still cause explicit restart/identity acceptance failure. This limitation is reported rather than treated as successful continuity. Recovery restores scheduler intent and does not claim recovery of an unsaved original serving expectation.

No remaining actionable source blocker found in this scope. No local build, maintenance window, service stop, or installed acceptance was performed by this reviewer. CI and a separately authorized real maintenance/continuity receipt remain necessary before claiming operational success.

[joelteply]

Independent source review by Codex retirement_review: APPROVE at exact head 5253446, carrying forward the bounded-maintenance source review and the subsequent fixture repairs.

Reviewed the engine/core fixture boundary: engine no longer calls upward into core, core owns the real child and daemon transaction, and the private exit observation is exposed only through the test-fixtures module. Existing generation fencing, checkpoint, cancellation, retry and honest readiness-failure assertions remain. The added /props response reports the fixture's actual four-slot pool required by checkpoint discovery; it does not bypass production admission. Early completion still fails, now reporting join/command errors without requiring Debug on the successful corpus. The exact CI selector requires one executed passing test.

No remaining source blocker found. Author reports all required CI green, including the actual connected Windows regression (retained b705-windows-5253446-success.log). I performed no local compilation or live maintenance. Installed continuity and capacity recovery are still separate acceptance work; source/CI approval is not a claim that a maintenance window has run successfully on the serving node.