[danjboyd]

Windows production remains refused by propane. This draft proposes listener ownership/transfer, generation drain/reload, jobs-worker supervision and native SCM deployment, and adds an isolated native lifecycle fixture without changing shared runtime code.

Based on e26a755, per Dan's ask #89. Rechecked #275: current watch source already uses suspended launch, assign-before-resume and kill-on-close containment; no watch change or issue closure is included.

Validation: native clang C11 with -Wall -Wextra -Werror; six focused tests pass (owner crash, job close, cooperative stop, forced deadline, unready-candidate isolation, ready replacement ordering). These prove process/event primitives only, not Winsock handoff, HTTP drain, queue recovery or SCM behavior. Local docs-api, docs-html and ci-docs quality gates passed. Dan approved existing automatic PR checks in ask #147; no manual CI jobs were dispatched.

Architecture decisions requested from Dan:

• Supervisor-owned Winsock transfer versus a stable front proxy.
• Native SCM ownership and supported service-account/platform matrix.
• Independent jobs-worker service and single-scheduler ownership.
• Readiness/drain/restart budgets and long-lived stream policy as propane accessories.
• Accept overlap and post-commit rollback semantics.

Draft only. Production refusal guards remain on. No service installation, provisioning, shared runtime/module changes, ABI/toolchain pins, merge, tag or release.

Local documentation validation: make docs-api docs-html ci-docs PASS; generated API files unchanged. Six native tests PASS. Published as a draft after Dan approved normal automatic PR checks in ask #147.