[deku2026]

A holder's final live violation query can miss an earlier Windows memory-notification crossing after memory release and another query. Specify durable job_memory evidence from the attempt job's peak above its enabled notification threshold, queried from the actual job at exit-record time. Keep the existing nonzero-exit condition; exit0 remains EXITED. This reports threshold evidence, not proof of hard-cap allocation refusal. AD-0005 amendment/date and execution section7 agree; no enum/RPC/schema migration, enforcement action or later feature.

Real Windows discriminating baseline at source test-only9ec4939 with unchanged production: Release0 warnings/errors,2 recovered MEMORY_LIMIT-vs-EXITED failures+3 controls, no skips13.413 s, testexit2/wrapper0. Peaks307466240/221958144 exceed current notifications268435456/167772160 while below hard402653184. Real post-release queries remove the durable marker under old code. Zero-exit, below-threshold and unread-notification controls pass. Initial4/4 and5/5 diagnostic batches retained separately because notifications remained/recurred; neither is called a failing baseline.

Reviewed headcd2ed1367d9479eaf70dab78bf20cd5b291e9045, treee0fab623ef594f531e9bc5293fc0309b4113eb10, base2d9995e78c4aa0f6327371ab0b5639857718da5c. Author design/protoc25/both schemas zero errors, generated C# AOT-compatible zero warnings,47 Linux tool tests pass, final wording rechecked, diff clean. Merged as 9da4127003a90842ddafeb03a6f07e7c5877f34c after complete native Windows3 steps/12 s and Linux3 steps/45 s passed. All six results, wrappers0 and required exact-head success statuses read with fresh main/head/tree. Direct review and gate.

Merged before implementation#57. Same-user changes keep the existing guardrail boundary; real tests use actual NodeHost/jobs/holder/allocation/query and isolated external keys, with no fake samples. OpenAI Codex direct work/review alone under explicit user instruction; no independent reviewer claimed.

Generated by OpenAI Codex.

[deku2026]

Direct self-review at exact headcd2ed1367d9479eaf70dab78bf20cd5b291e9045/treee0fab623ef594f531e9bc5293fc0309b4113eb10, base2d9995e78c4aa0f6327371ab0b5639857718da5c. Full two-file diff read against existing Windows notification/nonzero exit rule, holder/one-completion-port recovery and same-user guardrail. No unresolved findings. The current enabled threshold is read from the attempt's actual job; peak evidence survives released memory and a query/consumer sequence, independent of the higher hard cap or startup copy. Exit0 remains EXITED, no allocation-refusal claim is introduced. ADR date amended; no enum/RPC/schema/feature activation. Actual baseline9ec4939 gives two failed recovery reasons with markers absent after post-release queries, plus3 controls; initial4/4 and5/5 diagnostic batches retained separately. Primary Win32 docs: https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-jobobject_notification_limit_information and https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-jobobject_limit_violation_information. Full final-head native Windows3/12 s and Linux3/45 s passed; all six summary results, both wrapper exits0 and required engine statuses success read. Windows summary20261026-025257-cd2ed1367d94-win; Linux20261026-105249-cd2ed1367d94-linux. Fresh Design main/head/tree unchanged. OpenAI Codex direct work/review under explicit no-agent instruction; no independent reviewer claimed. Merge this Design dependency before implementation.