[aaltshuler]

Implements the candidate in the served-optimization RFC, which remains draft. Today optimize opens storage directly and cannot safely operate beside a server that owns the root. This adds authenticated optimization through the owning server and retained original-ID lookup after a client disconnects.

The existing native admission, engine gates and single manifest publication remain authoritative. A bounded conditional journal records acceptance before effects; exact source inventory and receipt capacity are reserved before rewriting. Interrupted operations block new writable admission and are reconciled by explicit administrator recovery of the original ID, without rerunning optimization. HTTP, direct CLI and engine entry points enforce the new optimize policy action on main: existing installed policies must explicitly grant it. The existing CLI gains observation and recovery flags; typed routes, OpenAPI, user guidance and a breaking-change note describe the contract.

The candidate passed 405 focused tests before rebasing onto current main, including policy denial, complete source accounting, report-capacity refusal, duplicates and response loss, receipt eviction, interruption/recovery, shutdown admission, CLI recovery and OpenAPI. Changed-package Clippy passed with warnings denied. On the current rebased commit, the selected-package build and 125 focused tests pass: 14 CLI/Studio integrations, two CLI receipt-delivery unit tests, 108 OpenAPI/MCP checks and the DST cost golden. Formatting, diff checks and documentation validation (408 Markdown files) also pass; full CI is pending. The DST golden adds exactly three lines for a reopened six-row bounded-optimization fixture: 59 l.get, 4 l.list and 40 l.put calls, excluding fixture setup and verification. Existing operation costs are unchanged by this patch.

For review: this is a disabled-by-default native prerequisite, not an independent worker or scheduler. Input ceilings do not prove CPU, memory or I/O allocation; new work under root-bound signed-token and OIDC profiles remains refused until that resource contract is qualified. Local tests do not establish live cloud settlement or production resource ceilings. The RFC and durable recovery/journal contract need review before this draft is considered merge-ready. Cluster maintenance has no MCP binding in this slice.