[joelteply]

The published maintenance command refused before drain on the real Windows host because Task Scheduler omits Enabled when it is true. Normalize that optional mutable element out of registration identity; keep authoritative COM Enabled, raw XML, security descriptor and remaining registration identity intact.

The existing Windows custody fixture now uses actual unregistered Scheduler COM definitions and retains interrupted restoration assertions. Direct PS5 production-reader checks passed default-enabled, disable, reenable and registration drift without changing registered tasks. Native Windows CI remains required. The failed live attempt left serving untouched and Deploy was restored; no disk recovery claimed. Earlier pending journals fail closed rather than being rewritten.

This restores the supported maintenance path needed to unblock citizen deployment while preserving their durable work. Follow-up to #5302, maintenance card b7053790.

[joelteply]

Independent source review by Codex retirement_review: APPROVE exact 3ad379e.

This matches the reviewed narrow correction: normalize comparison XML whitespace and exclude only Task/Settings/Enabled, whose omitted schema-default spelling previously caused refusal. Untouched raw XML, actual COM Enabled state, SDDL and other registration content remain evidence. The existing interrupted-restoration fixture now uses real unregistered Schedule.Service task definitions, preserving failure cases without registering or mutating OS tasks.

Compatibility caveat: journals persisted with the prior identity normalization may fail closed under the new comparison. This patch does not claim transparent migration; retain such evidence rather than rewriting it. Author reports no pending journal on the inspected installed node and all required CI green. No remaining source blocker; no local build or live maintenance performed by this reviewer. Installed maintenance acceptance remains separate.