[aaltshuler]

Design review now lives in the separate served-optimization RFC PR #1186. The RFC and its registry entry have been removed from this implementation diff. The proposal uses a smaller synchronous execution contract: control-plane orchestration/history, native execution safety, exact completed responses and explicit unknown outcomes. It defers durable maintenance journals, original-ID lookup and offline recovery. The code below still implements the earlier protocol and needs alignment before this draft is ready.

The implementation and test notes below describe the earlier candidate at 769c163c; they do not establish conformance with the revised RFC.

The earlier implementation follows the candidate in the served-optimization RFC, which remains draft. Today optimize opens storage directly and cannot safely operate beside a server that owns the root. This adds authenticated optimization through the owning server and retained original-ID lookup after a client disconnects.

The existing native admission, engine gates and single manifest publication remain authoritative. A bounded conditional journal records acceptance before effects; exact source inventory and receipt capacity are reserved before rewriting. Interrupted operations block new writable admission and are reconciled by explicit administrator recovery of the original ID, without rerunning optimization. HTTP, direct CLI and engine entry points enforce the new optimize policy action on main: existing installed policies must explicitly grant it. The existing CLI gains observation and recovery flags; typed routes, OpenAPI, user guidance and a breaking-change note describe the contract.

The candidate passed 405 focused tests before rebasing onto current main, including policy denial, complete source accounting, report-capacity refusal, duplicates and response loss, receipt eviction, interruption/recovery, shutdown admission, CLI recovery and OpenAPI. Changed-package Clippy passed with warnings denied. At 769c163c, the selected-package build and 125 focused tests pass: 14 CLI/Studio integrations, two CLI receipt-delivery unit tests, 108 OpenAPI/MCP checks and the DST cost golden. Formatting, diff checks and documentation validation (408 Markdown files) also pass; full CI is pending. The DST golden adds exactly three lines for a reopened six-row bounded-optimization fixture: 59 l.get, 4 l.list and 40 l.put calls, excluding fixture setup and verification. Existing operation costs are unchanged by this patch.

For review: this is a disabled-by-default native prerequisite, not an independent worker or scheduler. Input ceilings do not prove CPU, memory or I/O allocation; new work under root-bound signed-token and OIDC profiles remains refused until that resource contract is qualified. Local tests do not establish live cloud settlement or production resource ceilings. The implementation must be aligned with the revised RFC and its qualification gates before this draft is considered merge-ready. Cluster maintenance has no MCP binding in this slice.