v0.13.0 — restart-safe Goals and direct service ownership

Highlights

• Unfinished Goals can continue in bounded, restart-safe slices under exact lane, session, generation, and ownership authority. New same-lane user input takes priority before an unleased continuation.
• Windows supervision now supports the intended thin topology: one operating-system launch adapter, one Rust supervisor-master, and directly owned configured service children. The prior reconcile keeper and per-service supervisors remain available for migration and rollback.
• Queue/app-server process cleanup, lease release, terminal-control handling, ingress recovery, final delivery, and source ownership are hardened across crash and restart boundaries.
• Reconcile-managed operations derive stop, status, and start targets from configured topology, including overrides and multiple Telegram accounts, while legacy Scheduled Task plans remain compatible. This completes issue #17.
• Agent-created skill changes retain proposal, lint, guard, checksum, backup, receipt, quarantine, and rollback gates while supporting guarded autonomous apply. The public roadmap now prioritizes outcome attribution, shadow routing, one reversible serving cohort, and one measurable learning loop.

Verification

• full serial Rust workspace/all-target suite: 1,681 passed, 0 failed, 1 ignored;
• Windows direct-owner lifecycle suite: 13/13 passed;
• ops-control acceptance/fail-closed suite: 15/15 passed;
• Discord gateway tests: 7/7 passed;
• workspace all-target check, formatting, catalog readback, generated topology readback, and tracked-tree public hygiene passed;
• a guarded Windows release-candidate cutover passed independent review, stopped-state migration, one-master/direct-child process and health readback, rollback readiness, and exact-lane Telegram and Discord delivery.

Evidence boundaries

This source release does not claim that the exact tagged artifact has been promoted to the live deployment, that a long-duration endurance soak has completed, or that Linux and macOS have direct-owner containment and host-recovery parity. Linux currently has native process identity and ownership leases; direct ownership still fails before mutation on unsupported hosts.