weir-harness 1.1.2 → 1.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weir-harness",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "type": "module",
   "description": "Weir \u2014 orchestrator-centric DSH agent preset: intent gate, category delegation, todo driver, pull-based background jobs, auto-compaction, hashline edit.",
   "license": "MIT",

package/src/capabilities/lifecycle-snapshot.js

@@ -93,6 +93,8 @@ function fsyncPath(path) {
 
 /** fsync one directory entry change (mirrors the fs-adapter fsyncDir step). @param {string} dir */
 function fsyncDirectory(dir) {
+  // Directory fsync is POSIX-only (EPERM on win32 — same gate as fs-adapter.js).
+  if (process.platform !== 'darwin' && process.platform !== 'linux') return
   const fd = openSync(dir, 'r')
   try {
     fsyncSync(fd)

package/src/capabilities/store/checked-contract.d.ts

@@ -26,6 +26,7 @@ declare module 'node:os' {
 }
 declare var process: {
   pid: number;
+  platform: string;
   kill(pid: number, signal?: number): void;
 };
 

package/src/capabilities/store/fs-adapter.js

@@ -18,6 +18,35 @@ import { link, mkdir, open, readFile, readdir, rename, unlink } from 'node:fs/pr
  * }} StoreFs
  */
 
+// Directory fsync is a POSIX crash-durability idiom: on Windows the directory
+// handle opens but sync fails EPERM (verified on Node v24, NTFS). The win32
+// store row (SUPPORTED_PLATFORMS in store.js) therefore commits with
+// file-level fsync + atomic rename only — the same platform stance the
+// edit-lock reservation already takes (reservation.js SYNC_SUPPORTED). The
+// durability tradeoff is documented in docs/features/session-capability-manager.md.
+const DIR_SYNC_SUPPORTED = process.platform === 'darwin' || process.platform === 'linux'
+
+// Windows file-locking etiquette: antivirus and the search indexer briefly
+// hold brand-new files, so unlink/rename/link can fail transiently with
+// EPERM/EACCES/EBUSY (observed in the cross-process suite). POSIX rows never
+// see those codes from these operations; the win32 row retries a few times
+// before surfacing the error.
+const WINDOWS = process.platform === 'win32'
+const TRANSIENT_LOCK = new Set(['EPERM', 'EACCES', 'EBUSY'])
+
+/** @param {() => Promise<unknown>} op @returns {Promise<void>} */
+async function retryTransientLock(op) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      await op()
+      return
+    } catch (error) {
+      if (!WINDOWS || !TRANSIENT_LOCK.has(/** @type {{ code?: string }} */ (error)?.code ?? '') || attempt >= 4) throw error
+      await new Promise(resolve => setTimeout(resolve, 10 * (attempt + 1)))
+    }
+  }
+}
+
 /** @returns {StoreFs} */
 export function createNodeFs() {
   return {
@@ -38,14 +67,15 @@ export function createNodeFs() {
         await handle.close()
       }
     },
-    link: (from, to) => link(from, to),
-    rename: (from, to) => rename(from, to),
-    unlink: path => unlink(path),
+    link: (from, to) => retryTransientLock(() => link(from, to)),
+    rename: (from, to) => retryTransientLock(() => rename(from, to)),
+    unlink: path => retryTransientLock(() => unlink(path)),
     readdir: path => readdir(path),
     async mkdirp(path) {
       await mkdir(path, { recursive: true, mode: 0o700 })
     },
     async fsyncDir(path) {
+      if (!DIR_SYNC_SUPPORTED) return
       const handle = await open(path, 'r')
       try {
         await handle.sync()

package/src/capabilities/store/liveness.js

@@ -3,7 +3,7 @@
 // belongs to a process with a different OS start time (pid reuse), or the pid
 // is ours but carries another boot nonce. Everything else is 'alive' or
 // 'unknown', and neither may ever be reclaimed automatically.
-import { execFile } from 'node:child_process'
+import { execFile as nodeExecFile } from 'node:child_process'
 import { randomBytes } from 'node:crypto'
 import { hostname } from 'node:os'
 
@@ -24,18 +24,47 @@ const PROCESS_BOOT_NONCE = randomBytes(8).toString('hex')
 /** @param {number} pid @returns {Promise<string|null>} */
 export function psStartTime(pid) {
   return new Promise(resolve => {
-    execFile('ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8', timeout: 5000 }, (error, stdout) => {
+    nodeExecFile('ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8', timeout: 5000 }, (error, stdout) => {
       const text = error ? '' : String(stdout).trim()
       resolve(text.length > 0 ? text : null)
     })
   })
 }
 
+// Windows has no ps(1): the process start time comes from Windows PowerShell,
+// present on every supported Windows host (verified: powershell.exe Get-Process
+// StartTime.ToFileTimeUtc(), ~0.5s warm). The probe fails closed to null — an
+// unreadable start time is 'unknown', never 'dead'. The pid is interpolated
+// only after the integer check below and the callers' own validation
+// (parseOwnerDoc requires a safe integer; state() re-checks before probing).
+/**
+ * @param {number} pid
+ * @param {((file: string, args: string[], options: object, callback: (error: Error | null, stdout: string) => void) => void)} [execFileImpl]
+ * @returns {Promise<string|null>}
+ */
+export function windowsStartTime(pid, execFileImpl = /** @type {any} */ (nodeExecFile)) {
+  return new Promise(resolve => {
+    if (!Number.isSafeInteger(pid) || pid <= 0) { resolve(null); return }
+    execFileImpl('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', `(Get-Process -Id ${pid}).StartTime.ToFileTimeUtc()`], { encoding: 'utf8', timeout: 5000, windowsHide: true }, (error, stdout) => {
+      const text = error ? '' : String(stdout).trim()
+      resolve(/^[0-9]+$/.test(text) ? text : null)
+    })
+  })
+}
+
+/** Module-level self start-identity: the own-process start time never changes,
+ * so the default configuration pays the start-time probe once per process (on
+ * win32 that probe is a subprocess) instead of once per store instance.
+ * Injected pids, boot nonces or probes bypass this cache.
+ * @type {Promise<StartIdentity>|undefined} */
+let selfIdentity
+
 /**
  * @param {{
  *   pid?: number,
  *   host?: string,
  *   bootNonce?: string,
+ *   platform?: string,
  *   kill?: (pid: number) => void,
  *   startTime?: (pid: number) => Promise<string|null>,
  * }} [options]
@@ -46,7 +75,8 @@ export function createLiveness(options = {}) {
   const host = options.host ?? hostname()
   const bootNonce = options.bootNonce ?? PROCESS_BOOT_NONCE
   const kill = options.kill ?? (target => { process.kill(target, 0) })
-  const startTime = options.startTime ?? psStartTime
+  const platform = options.platform ?? process.platform
+  const startTime = options.startTime ?? (platform === 'win32' ? windowsStartTime : psStartTime)
   /** @type {Promise<StartIdentity>|undefined} */
   let self
 
@@ -64,6 +94,10 @@ export function createLiveness(options = {}) {
     pid,
     host,
     identity() {
+      if (pid === process.pid && bootNonce === PROCESS_BOOT_NONCE && options.startTime === undefined) {
+        selfIdentity ??= startTime(pid).then(osStart => ({ osStart, bootNonce }))
+        return selfIdentity
+      }
       self ??= startTime(pid).then(osStart => ({ osStart, bootNonce }))
       return self
     },

package/src/capabilities/store/store.js

@@ -9,8 +9,13 @@ import { createLockProtocol } from './lock.js'
 import { isFileSegment, isSegment, resolveStoreRoot, unitLayout } from './paths.js'
 import { decodeRecord, digestOf, encodeRecord } from './record.js'
 
-/** Platforms whose rename/fsync/link matrix row is EXECUTED (C-1.10 §6). */
-export const SUPPORTED_PLATFORMS = Object.freeze(['darwin'])
+/**
+ * Platforms whose rename/fsync/link matrix row is EXECUTED (C-1.10 §6 darwin
+ * row; win32 row: openspec windows-platform-adaptation — hard-link EEXIST,
+ * rename-replace, file fsync and kill(pid,0) verified on NTFS with Node v24.
+ * Directory fsync is skipped on win32, see fs-adapter.js).
+ */
+export const SUPPORTED_PLATFORMS = Object.freeze(['darwin', 'win32'])
 
 /**
  * @typedef {import('./paths.js').Unit} Unit

package/src/edit-lock/admin-recovery.js

@@ -41,8 +41,9 @@ async function boundedRead(path, pins) {
   verify(pins)
   const before = lstatSync(path)
   check(before.isFile() && !before.isSymbolicLink() && before.nlink === 1 && before.size <= MAX_RECOVERY_BYTES, 'Bounded single-link regular authority file required')
-  check(constants.O_NOFOLLOW && constants.O_NONBLOCK, 'Safe file IO unsupported')
-  const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK)
+  // win32: O_NOFOLLOW/O_NONBLOCK are undefined; the lstat above refused a symlink
+  // leaf and the post-open identity check below bounds the swap (read-authority.js).
+  const file = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0))
   try {
     const stat = await file.stat()
     check(same(before, stat) && stat.isFile() && stat.nlink === 1 && stat.size <= MAX_RECOVERY_BYTES, 'Opened file identity or bound changed')
@@ -60,6 +61,8 @@ async function boundedRead(path, pins) {
   } finally { await file.close() }
 }
 async function syncDirectory(directory) {
+  // Directory fsync is POSIX-only (EPERM on win32, reservation.js SYNC_SUPPORTED).
+  if (process.platform !== 'darwin' && process.platform !== 'linux') return
   const handle = await open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW)
   try { await handle.sync() } finally { await handle.close() }
 }
@@ -123,7 +126,9 @@ export async function recoverAuthority(input, testing = {}) {
     check(savedBackup.equals(bytes), 'Existing backup does not match exact authority bytes')
     parseSnapshot(savedBackup, input.root)
     // Also sync an existing backup when retrying a crash before its first fsync.
-    const backupHandle = await open(join(directory, backup.file), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK)
+    // fsync needs a writable handle on Windows (EPERM on O_RDONLY): open the
+    // existing backup read-write there so the re-sync stays a real fsync.
+    const backupHandle = await open(join(directory, backup.file), process.platform === 'win32' ? 'r+' : constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0))
     try { await backupHandle.sync() } finally { await backupHandle.close() }
     await syncDirectory(directory)
     await testing.checkpoint?.('backup-durable')

package/src/edit-lock/admission.js

@@ -1,4 +1,4 @@
-import { posix } from 'node:path'
+import { posix, win32 } from 'node:path'
 
 /** Candidates describe effects, not merely explicit API arguments. Session-wide
  * operations must enumerate affected ownership at their FIFO position.
@@ -11,9 +11,19 @@ import { posix } from 'node:path'
  * Opaque kernel test IDs remain valid without fences but cannot prove non-overlap.
  * @param {string} resourceId */
 function canonicalResource(resourceId) {
-  return typeof resourceId === 'string' && resourceId.startsWith('/') &&
-    !resourceId.includes('\0') && resourceId !== '/' &&
+  if (typeof resourceId !== 'string' || resourceId.includes('\0')) return false
+  // Shape check only, NOT filesystem proof. The POSIX arm is every POSIX row
+  // plus the platform-neutral synthetic ids historical records may carry; the
+  // win32 arm is the NTFS-native shape the resource-identity win32 row
+  // produces. Real producers emit exactly one shape per platform; relative,
+  // root, trailing-slash and non-normalized spellings stay refused.
+  const posixCanonical = resourceId.startsWith('/') && resourceId !== '/' &&
     !resourceId.endsWith('/') && posix.normalize(resourceId) === resourceId
+  if (process.platform !== 'win32') return posixCanonical
+  return posixCanonical ||
+    (/^[A-Za-z]:\\/.test(resourceId) && resourceId.length > 3 &&
+      !resourceId.endsWith('\\') && !resourceId.includes('/') &&
+      win32.normalize(resourceId) === resourceId)
 }
 
 /** Pure denial check. Historical closeout assertions grant no authority.

package/src/edit-lock/operation-history.js

@@ -100,7 +100,7 @@ export function validateOperations(state) {
         if (op.binding.target.kind === 'update') valid(op.outcome.resourceId === op.binding.target.resourceId && op.outcome.generation === op.binding.target.generation, 'update outcome binding')
         if (op.phase === 'created' && op.fence?.kind === 'subtree') {
           const suffix = relative(op.fence.ancestor, op.outcome.resourceId)
-          valid(suffix.length > 0 && suffix !== '..' && !suffix.startsWith('../') && !isAbsolute(suffix), 'created containment')
+          valid(suffix.length > 0 && suffix !== '..' && !suffix.startsWith('../') && !suffix.startsWith('..\\') && !isAbsolute(suffix), 'created containment')
         }
       }
     }
@@ -137,7 +137,7 @@ function validateFence(op) {
     else {
       valid(fence.basis === 'conservative-ancestor', 'scope basis')
       const suffix = relative(fence.ancestor, target.ancestor)
-      valid(suffix !== '..' && !suffix.startsWith('../') && !isAbsolute(suffix), 'conservative containment')
+      valid(suffix !== '..' && !suffix.startsWith('../') && !suffix.startsWith('..\\') && !isAbsolute(suffix), 'conservative containment')
     }
   } else {
     shape(fence, ['kind', 'basis'])

package/src/edit-lock/read-authority.js

@@ -72,8 +72,11 @@ export function readSnapshotBytes(authorityDir) {
       return { presence: 'no-snapshot' }
     }
     if (!leaf.isFile() || leaf.isSymbolicLink()) return { presence: 'not-a-file' }
-    if (!constants.O_NOFOLLOW) throw new Error('safe inspection unsupported on this platform')
-    fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK)
+    // Windows exposes no O_NOFOLLOW/O_NONBLOCK (constants undefined): the leaf
+    // lstat above already refused a symlink and the post-open fstat identity
+    // check below bounds the swap window (symlink creation needs privilege on
+    // Windows; the residual TOCTOU gap is documented in edit-lock.md).
+    fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0))
     const opened = fstatSync(fd)
     if (!opened.isFile() || !sameNode(leaf, opened)) throw new Error('opened snapshot identity changed')
     verifyPins(parents)

package/src/edit-lock/remote.js

@@ -7,17 +7,29 @@ import { createEditLockPeer } from './peer.js'
 import { serveEditLockPeer } from './peer-transport.js'
 import { createEditLockPeerClient } from './peer-client.js'
 
-/** Deterministic per-user endpoint for one canonical authority directory. The
- * OS temp directory is user-private on supported hosts; any same-user process
- * that can reach it is inside the cooperative trust boundary, not attested.
- * @param {string} directory */
-export function endpointFor(directory) {
+/** Deterministic per-user endpoint for one canonical authority directory. On
+ * POSIX hosts the OS temp directory is user-private and the endpoint is a
+ * domain-socket file; on Windows it is a named pipe (a kernel object with no
+ * filesystem node, so there is no stale-node sweep and no 100-byte path
+ * budget — only the 256-char pipe-name limit) whose name carries no
+ * backslashes beyond the \\.\pipe\ prefix (verified on Node v24). Any
+ * same-user process that can reach the endpoint is inside the cooperative
+ * trust boundary, not attested.
+ * @param {string} directory @param {string} [platform] */
+export function endpointFor(directory, platform = process.platform) {
   const authority = realpathSync.native(directory)
-  const path = join(tmpdir(), `weir-edit-lock-${createHash('sha256').update(authority).digest('hex').slice(0, 24)}.sock`)
+  const hash = createHash('sha256').update(authority).digest('hex').slice(0, 24)
+  if (platform === 'win32') return `\\\\.\\pipe\\weir-edit-lock-${hash}`
+  const path = join(tmpdir(), `weir-edit-lock-${hash}.sock`)
   if (Buffer.byteLength(path) > 100) throw new Error(`edit lock endpoint path too long: ${path}`)
   return path
 }
 
+/** True for Windows named-pipe endpoints: no filesystem node exists, so the
+ * stale-socket sweep and the close-time unlink are POSIX-only concerns.
+ * @param {string} endpoint */
+const namedPipe = endpoint => endpoint.startsWith('\\\\.\\pipe\\') || endpoint.startsWith('\\\\?\\pipe\\')
+
 /** Publisher side: one session channel per connection. The first frame must be
  * `open {sessionId}`; the channel agent is fixed afterwards and EOF revokes it.
  * Call only while holding the publisher reservation (stale socket removal).
@@ -25,10 +37,12 @@ export function endpointFor(directory) {
  * @param {string} endpoint
  * @param {WeakMap<object, (event: unknown) => void>} sinks remote agent → notice sink */
 export async function serveEditLockEndpoint(lifecycle, endpoint, sinks) {
-  try {
-    if (!lstatSync(endpoint).isSocket()) throw new Error(`unexpected node at edit lock endpoint ${endpoint}`)
-    unlinkSync(endpoint)
-  } catch (error) { if (/** @type {any} */ (error)?.code !== 'ENOENT') throw error }
+  if (!namedPipe(endpoint)) {
+    try {
+      if (!lstatSync(endpoint).isSocket()) throw new Error(`unexpected node at edit lock endpoint ${endpoint}`)
+      unlinkSync(endpoint)
+    } catch (error) { if (/** @type {any} */ (error)?.code !== 'ENOENT') throw error }
+  }
   /** @type {Set<{close: () => Promise<unknown>}>} */
   const channels = new Set()
   let closed = false
@@ -63,7 +77,9 @@ export async function serveEditLockEndpoint(lifecycle, endpoint, sinks) {
       closed = true
       await new Promise(resolve => server.close(() => resolve(undefined)))
       const results = await Promise.allSettled([...channels].map(channel => channel.close()))
-      try { unlinkSync(endpoint) } catch { /* already gone */ }
+      if (!namedPipe(endpoint)) {
+        try { unlinkSync(endpoint) } catch { /* already gone */ }
+      }
       const errors = results.filter(result => result.status === 'rejected').map(result => /** @type {any} */ (result).reason)
       if (errors.length) throw new AggregateError(errors, 'edit lock endpoint revocation failed')
     },

package/src/edit-lock/reservation.js

@@ -48,8 +48,12 @@ function writeOwner(path, doc) {
   renameSync(temporary, join(path, OWNER_FILE))
 }
 
+// fsync on a directory handle is a POSIX crash-durability idiom: on Windows
+// the handle opens but fsync fails EPERM (verified on Node v24, NTFS), so the
+// win32 row skips it — the owner temp+rename stands on NTFS journaling.
 /** @param {string} directory */
 function syncParent(directory) {
+  if (process.platform !== 'darwin' && process.platform !== 'linux') return
   const handle = openSync(directory, constants.O_RDONLY | (constants.O_DIRECTORY ?? 0))
   try { fsyncSync(handle) } finally { closeSync(handle) }
 }

package/src/edit-lock/resource-identity.js

@@ -10,14 +10,23 @@ import { dirname, isAbsolute } from 'node:path'
  */
 
 /**
- * Read-only POSIX observations, not ownership or publication authority.
+ * Read-only filesystem observations, not ownership or publication authority.
  * Filesystem calls are not an atomic snapshot: callers must coordinate mutation.
  * dev/ino continuity cannot detect inode reuse or change-and-restore (ABA).
+ *
+ * Verified platform rows: darwin/linux (POSIX spellings) and win32
+ * (openspec windows-platform-adaptation: drive-letter absolute spellings with
+ * both separators normalized to '/'; NTFS dev/ino/nlink verified real on Node
+ * v24; junctions are reparse points and surface as symbolic links). UNC and
+ * device paths are rejected on win32 — network shares are outside the
+ * supported envelope (edit-lock.md).
+ * @param {{ platform?: string }} [options]
  */
-export function createResourceIdentity() {
-  if (process.platform !== 'darwin' && process.platform !== 'linux') {
-    throw new Error(`unsupported platform: ${process.platform}`)
+export function createResourceIdentity({ platform = process.platform } = {}) {
+  if (platform !== 'darwin' && platform !== 'linux' && platform !== 'win32') {
+    throw new Error(`unsupported platform: ${platform}`)
   }
+  const win = platform === 'win32'
   /** @type {WeakMap<object, Evidence>} */
   const observations = new WeakMap()
   /** @param {string} filePath @param {{ cwd: string }} options */
@@ -25,7 +34,8 @@ export function createResourceIdentity() {
     if (typeof cwd !== 'string' || !isAbsolute(cwd)) throw new TypeError('expected absolute cwd')
     if (typeof filePath !== 'string' || filePath.length === 0) throw new TypeError('expected non-empty path')
     if (filePath.includes('\0') || cwd.includes('\0')) throw new TypeError('NUL in path')
-    const result = inspect(isAbsolute(filePath) ? filePath : `${cwd}/${filePath}`)
+    const joined = isAbsolute(filePath) ? filePath : `${cwd}/${filePath}`
+    const result = inspect(win ? normalizeWin(joined) : joined, win)
     const observation = Object.freeze(result.value)
     observations.set(observation, { filePath, cwd, kind: observation.kind, witnesses: result.witnesses, links: result.links })
     return observation
@@ -48,11 +58,22 @@ export function createResourceIdentity() {
   }
 }
 
+/** Canonical spelling for the win32 walk: single forward slashes under a
+ * drive-letter root. UNC/device roots are rejected, never reinterpreted.
+ * @param {string} spelling */
+function normalizeWin(spelling) {
+  const normalized = spelling.replace(/\\/g, '/').replace(/\/{2,}/g, '/')
+  if (!/^[A-Za-z]:\//.test(normalized)) throw new Error(`unsupported path root (drive-letter absolute paths only): ${spelling.slice(0, 64)}`)
+  return normalized
+}
+
 /** Walk original prefixes without lexically collapsing symlink/.. or missing/..
- * @param {string} spelling @returns {Inspection} */
-function inspect(spelling) {
+ * The ancestor chain terminates at the filesystem root of the spelling —
+ * '/' on POSIX, '<drive>:/' on win32 — detected as dirname's fixed point.
+ * @param {string} spelling @param {boolean} win @returns {Inspection} */
+function inspect(spelling, win) {
   const parts = spelling.split('/')
-  let ancestor = '/'
+  let ancestor = win ? /** @type {string} */ (parts[0]) : '/'
   const witnesses = []
   let links = 0
   for (let index = 1; index < parts.length; index++) {
@@ -71,11 +92,11 @@ function inspect(spelling) {
     ancestor = realpathSync.native(prefix)
     const node = statSync(ancestor, { bigint: true })
     witnesses.push(`${ancestor}:${node.dev}:${node.ino}:${entry.dev}:${entry.ino}`)
-    if (entry.isSymbolicLink()) traceLink(physical, witnesses, 0)
+    if (entry.isSymbolicLink()) traceLink(physical, witnesses, 0, win)
     for (let parent = dirname(ancestor); ; parent = dirname(parent)) {
       const directory = statSync(parent, { bigint: true })
       witnesses.push(`${parent}:${directory.dev}:${directory.ino}`)
-      if (parent === '/') break
+      if (parent === dirname(parent)) break
     }
     if (index < parts.length - 1) {
       if (!node.isDirectory()) throw new Error('non-directory ancestor')
@@ -90,18 +111,20 @@ function inspect(spelling) {
  * the physical cursor avoids recursively replaying the original parent spelling.
  * Resolve each component only AFTER tracing it: lexical .. collapse or resolving
  * the whole target up front would hide nested links and their topology changes.
- * @param {string} path @param {string[]} witnesses @param {number} depth */
-function traceLink(path, witnesses, depth) {
+ * On win32 readlink returns backslash spellings; they are normalized before the
+ * walk so component splitting matches the POSIX row.
+ * @param {string} path @param {string[]} witnesses @param {number} depth @param {boolean} win */
+function traceLink(path, witnesses, depth, win) {
   if (depth >= 40) throw new Error('unsupported symlink depth')
-  const target = readlinkSync(path)
+  const target = win ? readlinkSync(path).replace(/\\/g, '/') : readlinkSync(path)
   witnesses.push(`link:${path}:${target}`)
-  let parent = isAbsolute(target) ? '/' : dirname(path)
+  let parent = isAbsolute(target) ? (win ? /** @type {string} */ (target.split('/')[0]) : '/') : dirname(path)
   const parts = isAbsolute(target) ? target.split('/').slice(1) : target.split('/')
   for (const part of parts) {
     const prefix = `${parent}/${part}`
     const node = lstatSync(prefix, { bigint: true })
     witnesses.push(`${prefix}:${node.dev}:${node.ino}`)
-    if (node.isSymbolicLink()) traceLink(prefix, witnesses, depth + 1)
+    if (node.isSymbolicLink()) traceLink(prefix, witnesses, depth + 1, win)
     parent = realpathSync.native(prefix)
   }
 }

package/src/edit-lock/runtime.js

@@ -17,6 +17,9 @@ async function writeAuthorityFile(directory, file, bytes) {
   const handle = await open(temporary, 'wx', 0o600)
   try { await handle.writeFile(bytes); await handle.sync() } finally { await handle.close() }
   await rename(temporary, join(directory, file))
+  // Directory fsync is POSIX-only (EPERM on win32): the file fsync above and
+  // the atomic rename stand alone there (reservation.js SYNC_SUPPORTED stance).
+  if (process.platform !== 'darwin' && process.platform !== 'linux') return
   const dir = await open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW)
   try { await dir.sync() } finally { await dir.close() }
 }

package/src/edit-lock/stale-sweep.js

@@ -3,6 +3,7 @@
 // the scheduler's job, clock and timer are injected so the composition and
 // the unit tests share one core.
 import { lstatSync } from 'node:fs'
+import { dirname } from 'node:path'
 
 /** Missing-target classification for one stored canonical resource id. ONLY
  * ENOENT counts: a successful lstat — including of a dangling symlink — is
@@ -16,7 +17,23 @@ export function isMissingTarget(resourceId) {
     lstatSync(resourceId)
     return false
   } catch (error) {
-    return /** @type {any} */ (error)?.code === 'ENOENT'
+    const code = /** @type {any} */ (error)?.code
+    if (code !== 'ENOENT') return false
+    // Windows reports a path through a regular-file component as ENOENT as
+    // well (there is no ENOTDIR): preserve the conservative POSIX
+    // classification by walking up — a non-directory ancestor means the path
+    // is BLOCKED (skip the row), not missing.
+    if (process.platform === 'win32') {
+      for (let parent = dirname(resourceId); parent !== dirname(parent); parent = dirname(parent)) {
+        let stat
+        try { stat = lstatSync(parent) } catch (ancestorError) {
+          if (/** @type {any} */ (ancestorError)?.code === 'ENOENT') continue
+          return false
+        }
+        return stat.isDirectory()
+      }
+    }
+    return true
   }
 }
 

package/src/edit-lock/store.js

@@ -6,6 +6,11 @@ import { validateOperationTransitions } from './operation-history.js'
 import { canonical, parseSnapshot, validateImage } from './snapshot.js'
 import { validateAdminTransition } from './admin-ledger.js'
 
+// Directory fsync is POSIX-only (EPERM on win32, Node v24 — same stance as
+// reservation.js SYNC_SUPPORTED): the win32 row persists with file fsync +
+// atomic rename and skips the directory sync steps.
+const DIR_SYNC_SUPPORTED = process.platform === 'darwin' || process.platform === 'linux'
+
 /**
  * Unmounted historical Edit Lock snapshot storage, NOT a kernel restore interface.
  * The caller MUST already hold an externally proven exclusive directory lifecycle
@@ -79,11 +84,14 @@ export async function openEditLockStore({ directory, domainId, mode, maxSnapshot
       await io('file-sync', async () => { await openedFile.sync() })
       await io('file-close', async () => { await openedFile.close(); file = undefined })
       await io('rename', async () => { renameStarted = true; await rename(temporary, target) })
-      await io('directory-open', async () => { dir = await open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW) })
-      valid(dir, 'opened directory descriptor')
+      // The directory steps fire on every platform — checkpoint cadence is a
+      // contract; only the real directory fsync is POSIX-only (EPERM on win32,
+      // same stance as reservation.js SYNC_SUPPORTED).
+      await io('directory-open', async () => { dir = DIR_SYNC_SUPPORTED ? await open(directory, constants.O_RDONLY | (constants.O_DIRECTORY ?? 0) | (constants.O_NOFOLLOW ?? 0)) : undefined })
+      if (DIR_SYNC_SUPPORTED) valid(dir, 'opened directory descriptor')
       const openedDirectory = dir
-      await io('directory-sync', async () => { await openedDirectory.sync() })
-      await io('directory-close', async () => { await openedDirectory.close(); dir = undefined })
+      await io('directory-sync', async () => { await openedDirectory?.sync() })
+      await io('directory-close', async () => { await openedDirectory?.close(); dir = undefined })
       committedBytes = Buffer.from(bytes, 'utf8')
     } catch (cause) {
       // Never remove/promote a temp or roll back a rename. Once rename was
@@ -108,7 +116,9 @@ export async function openEditLockStore({ directory, domainId, mode, maxSnapshot
     await persist(current)
   } else {
     valid((await lstat(target)).isFile(), 'snapshot must be regular file')
-    const file = await open(target, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK)
+    // win32: O_NOFOLLOW/O_NONBLOCK are undefined — the lstat above and the post-open
+    // stat below carry the identity checks (same stance as read-authority.js).
+    const file = await open(target, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0))
     try {
       valid((await file.stat()).isFile(), 'snapshot must be regular file')
       let bytes