A changed maintenance window is a changed spec (hq ADR 0189)

containerSpec says a changed cadence moves the marker so the install is
reported updated and re-established. Which containers are held still is the
same kind of statement, and a declaration that changed it while the machine
reported no change would be a machine quietly holding yesterday's containers.

internal/apply/apply.go

@@ -1707,6 +1707,13 @@ func containerSpecReading(r *declaration.Container, declares, reads map[string]s
 	// The cadence is part of what was declared, so a changed schedule is a changed spec — the marker
 	// moves and the install is reported "updated" and re-established. Added only when present, so no
 	// ordinary container's or run-once step's digest moves for a field it does not set.
+	// And which of its module's containers it holds still while it runs (novox/hq ADR 0189), for
+	// the same reason: a declaration that changed the window while the machine reported no change
+	// would be a machine quietly holding yesterday's containers. In declared order, which is the
+	// order they are stopped in.
+	for _, id := range r.WhileStopped {
+		b.WriteString("while-stopped " + id + "\n")
+	}
 	if r.Schedule != "" {
 		b.WriteString("schedule " + r.Schedule + "\n")
 	}