weir-harness 1.1.2 → 1.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weir-harness",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "type": "module",
   "description": "Weir \u2014 orchestrator-centric DSH agent preset: intent gate, category delegation, todo driver, pull-based background jobs, auto-compaction, hashline edit.",
   "license": "MIT",

package/src/capabilities/lifecycle-snapshot.js

@@ -93,6 +93,8 @@ function fsyncPath(path) {
 
 /** fsync one directory entry change (mirrors the fs-adapter fsyncDir step). @param {string} dir */
 function fsyncDirectory(dir) {
+  // Directory fsync is POSIX-only (EPERM on win32 — same gate as fs-adapter.js).
+  if (process.platform !== 'darwin' && process.platform !== 'linux') return
   const fd = openSync(dir, 'r')
   try {
     fsyncSync(fd)

package/src/capabilities/store/checked-contract.d.ts

@@ -26,6 +26,7 @@ declare module 'node:os' {
 }
 declare var process: {
   pid: number;
+  platform: string;
   kill(pid: number, signal?: number): void;
 };
 

package/src/capabilities/store/fs-adapter.js

@@ -18,6 +18,35 @@ import { link, mkdir, open, readFile, readdir, rename, unlink } from 'node:fs/pr
  * }} StoreFs
  */
 
+// Directory fsync is a POSIX crash-durability idiom: on Windows the directory
+// handle opens but sync fails EPERM (verified on Node v24, NTFS). The win32
+// store row (SUPPORTED_PLATFORMS in store.js) therefore commits with
+// file-level fsync + atomic rename only — the same platform stance the
+// edit-lock reservation already takes (reservation.js SYNC_SUPPORTED). The
+// durability tradeoff is documented in docs/features/session-capability-manager.md.
+const DIR_SYNC_SUPPORTED = process.platform === 'darwin' || process.platform === 'linux'
+
+// Windows file-locking etiquette: antivirus and the search indexer briefly
+// hold brand-new files, so unlink/rename/link can fail transiently with
+// EPERM/EACCES/EBUSY (observed in the cross-process suite). POSIX rows never
+// see those codes from these operations; the win32 row retries a few times
+// before surfacing the error.
+const WINDOWS = process.platform === 'win32'
+const TRANSIENT_LOCK = new Set(['EPERM', 'EACCES', 'EBUSY'])
+
+/** @param {() => Promise<unknown>} op @returns {Promise<void>} */
+async function retryTransientLock(op) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      await op()
+      return
+    } catch (error) {
+      if (!WINDOWS || !TRANSIENT_LOCK.has(/** @type {{ code?: string }} */ (error)?.code ?? '') || attempt >= 4) throw error
+      await new Promise(resolve => setTimeout(resolve, 10 * (attempt + 1)))
+    }
+  }
+}
+
 /** @returns {StoreFs} */
 export function createNodeFs() {
   return {
@@ -38,14 +67,15 @@ export function createNodeFs() {
         await handle.close()
       }
     },
-    link: (from, to) => link(from, to),
-    rename: (from, to) => rename(from, to),
-    unlink: path => unlink(path),
+    link: (from, to) => retryTransientLock(() => link(from, to)),
+    rename: (from, to) => retryTransientLock(() => rename(from, to)),
+    unlink: path => retryTransientLock(() => unlink(path)),
     readdir: path => readdir(path),
     async mkdirp(path) {
       await mkdir(path, { recursive: true, mode: 0o700 })
     },
     async fsyncDir(path) {
+      if (!DIR_SYNC_SUPPORTED) return
       const handle = await open(path, 'r')
       try {
         await handle.sync()

package/src/capabilities/store/liveness.js

@@ -3,7 +3,7 @@
 // belongs to a process with a different OS start time (pid reuse), or the pid
 // is ours but carries another boot nonce. Everything else is 'alive' or
 // 'unknown', and neither may ever be reclaimed automatically.
-import { execFile } from 'node:child_process'
+import { execFile as nodeExecFile } from 'node:child_process'
 import { randomBytes } from 'node:crypto'
 import { hostname } from 'node:os'
 
@@ -24,18 +24,47 @@ const PROCESS_BOOT_NONCE = randomBytes(8).toString('hex')
 /** @param {number} pid @returns {Promise<string|null>} */
 export function psStartTime(pid) {
   return new Promise(resolve => {
-    execFile('ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8', timeout: 5000 }, (error, stdout) => {
+    nodeExecFile('ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8', timeout: 5000 }, (error, stdout) => {
       const text = error ? '' : String(stdout).trim()
       resolve(text.length > 0 ? text : null)
     })
   })
 }
 
+// Windows has no ps(1): the process start time comes from Windows PowerShell,
+// present on every supported Windows host (verified: powershell.exe Get-Process
+// StartTime.ToFileTimeUtc(), ~0.5s warm). The probe fails closed to null — an
+// unreadable start time is 'unknown', never 'dead'. The pid is interpolated
+// only after the integer check below and the callers' own validation
+// (parseOwnerDoc requires a safe integer; state() re-checks before probing).
+/**
+ * @param {number} pid
+ * @param {((file: string, args: string[], options: object, callback: (error: Error | null, stdout: string) => void) => void)} [execFileImpl]
+ * @returns {Promise<string|null>}
+ */
+export function windowsStartTime(pid, execFileImpl = /** @type {any} */ (nodeExecFile)) {
+  return new Promise(resolve => {
+    if (!Number.isSafeInteger(pid) || pid <= 0) { resolve(null); return }
+    execFileImpl('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', `(Get-Process -Id ${pid}).StartTime.ToFileTimeUtc()`], { encoding: 'utf8', timeout: 5000, windowsHide: true }, (error, stdout) => {
+      const text = error ? '' : String(stdout).trim()
+      resolve(/^[0-9]+$/.test(text) ? text : null)
+    })
+  })
+}
+
+/** Module-level self start-identity: the own-process start time never changes,
+ * so the default configuration pays the start-time probe once per process (on
+ * win32 that probe is a subprocess) instead of once per store instance.
+ * Injected pids, boot nonces or probes bypass this cache.
+ * @type {Promise<StartIdentity>|undefined} */
+let selfIdentity
+
 /**
  * @param {{
  *   pid?: number,
  *   host?: string,
  *   bootNonce?: string,
+ *   platform?: string,
  *   kill?: (pid: number) => void,
  *   startTime?: (pid: number) => Promise<string|null>,
  * }} [options]
@@ -46,7 +75,8 @@ export function createLiveness(options = {}) {
   const host = options.host ?? hostname()
   const bootNonce = options.bootNonce ?? PROCESS_BOOT_NONCE
   const kill = options.kill ?? (target => { process.kill(target, 0) })
-  const startTime = options.startTime ?? psStartTime
+  const platform = options.platform ?? process.platform
+  const startTime = options.startTime ?? (platform === 'win32' ? windowsStartTime : psStartTime)
   /** @type {Promise<StartIdentity>|undefined} */
   let self
 
@@ -64,6 +94,10 @@ export function createLiveness(options = {}) {
     pid,
     host,
     identity() {
+      if (pid === process.pid && bootNonce === PROCESS_BOOT_NONCE && options.startTime === undefined) {
+        selfIdentity ??= startTime(pid).then(osStart => ({ osStart, bootNonce }))
+        return selfIdentity
+      }
       self ??= startTime(pid).then(osStart => ({ osStart, bootNonce }))
       return self
     },

package/src/capabilities/store/store.js

@@ -9,8 +9,13 @@ import { createLockProtocol } from './lock.js'
 import { isFileSegment, isSegment, resolveStoreRoot, unitLayout } from './paths.js'
 import { decodeRecord, digestOf, encodeRecord } from './record.js'
 
-/** Platforms whose rename/fsync/link matrix row is EXECUTED (C-1.10 §6). */
-export const SUPPORTED_PLATFORMS = Object.freeze(['darwin'])
+/**
+ * Platforms whose rename/fsync/link matrix row is EXECUTED (C-1.10 §6 darwin
+ * row; win32 row: openspec windows-platform-adaptation — hard-link EEXIST,
+ * rename-replace, file fsync and kill(pid,0) verified on NTFS with Node v24.
+ * Directory fsync is skipped on win32, see fs-adapter.js).
+ */
+export const SUPPORTED_PLATFORMS = Object.freeze(['darwin', 'win32'])
 
 /**
  * @typedef {import('./paths.js').Unit} Unit

package/src/edit-lock/admin-recovery.js

@@ -41,8 +41,9 @@ async function boundedRead(path, pins) {
   verify(pins)
   const before = lstatSync(path)
   check(before.isFile() && !before.isSymbolicLink() && before.nlink === 1 && before.size <= MAX_RECOVERY_BYTES, 'Bounded single-link regular authority file required')
-  check(constants.O_NOFOLLOW && constants.O_NONBLOCK, 'Safe file IO unsupported')
-  const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK)
+  // win32: O_NOFOLLOW/O_NONBLOCK are undefined; the lstat above refused a symlink
+  // leaf and the post-open identity check below bounds the swap (read-authority.js).
+  const file = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0))
   try {
     const stat = await file.stat()
     check(same(before, stat) && stat.isFile() && stat.nlink === 1 && stat.size <= MAX_RECOVERY_BYTES, 'Opened file identity or bound changed')
@@ -60,6 +61,8 @@ async function boundedRead(path, pins) {
   } finally { await file.close() }
 }
 async function syncDirectory(directory) {
+  // Directory fsync is POSIX-only (EPERM on win32, reservation.js SYNC_SUPPORTED).
+  if (process.platform !== 'darwin' && process.platform !== 'linux') return
   const handle = await open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW)
   try { await handle.sync() } finally { await handle.close() }
 }
@@ -123,7 +126,9 @@ export async function recoverAuthority(input, testing = {}) {
     check(savedBackup.equals(bytes), 'Existing backup does not match exact authority bytes')
     parseSnapshot(savedBackup, input.root)
     // Also sync an existing backup when retrying a crash before its first fsync.
-    const backupHandle = await open(join(directory, backup.file), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK)
+    // fsync needs a writable handle on Windows (EPERM on O_RDONLY): open the
+    // existing backup read-write there so the re-sync stays a real fsync.
+    const backupHandle = await open(join(directory, backup.file), process.platform === 'win32' ? 'r+' : constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0))
     try { await backupHandle.sync() } finally { await backupHandle.close() }
     await syncDirectory(directory)
     await testing.checkpoint?.('backup-durable')

package/src/edit-lock/admission.js

@@ -1,4 +1,4 @@
-import { posix } from 'node:path'
+import { posix, win32 } from 'node:path'
 
 /** Candidates describe effects, not merely explicit API arguments. Session-wide
  * operations must enumerate affected ownership at their FIFO position.
@@ -11,9 +11,19 @@ import { posix } from 'node:path'
  * Opaque kernel test IDs remain valid without fences but cannot prove non-overlap.
  * @param {string} resourceId */
 function canonicalResource(resourceId) {
-  return typeof resourceId === 'string' && resourceId.startsWith('/') &&
-    !resourceId.includes('\0') && resourceId !== '/' &&
+  if (typeof resourceId !== 'string' || resourceId.includes('\0')) return false
+  // Shape check only, NOT filesystem proof. The POSIX arm is every POSIX row
+  // plus the platform-neutral synthetic ids historical records may carry; the
+  // win32 arm is the NTFS-native shape the resource-identity win32 row
+  // produces. Real producers emit exactly one shape per platform; relative,
+  // root, trailing-slash and non-normalized spellings stay refused.
+  const posixCanonical = resourceId.startsWith('/') && resourceId !== '/' &&
     !resourceId.endsWith('/') && posix.normalize(resourceId) === resourceId
+  if (process.platform !== 'win32') return posixCanonical
+  return posixCanonical ||
+    (/^[A-Za-z]:\\/.test(resourceId) && resourceId.length > 3 &&
+      !resourceId.endsWith('\\') && !resourceId.includes('/') &&
+      win32.normalize(resourceId) === resourceId)
 }
 
 /** Pure denial check. Historical closeout assertions grant no authority.

package/src/edit-lock/operation-history.js

@@ -100,7 +100,7 @@ export function validateOperations(state) {
         if (op.binding.target.kind === 'update') valid(op.outcome.resourceId === op.binding.target.resourceId && op.outcome.generation === op.binding.target.generation, 'update outcome binding')
         if (op.phase === 'created' && op.fence?.kind === 'subtree') {
           const suffix = relative(op.fence.ancestor, op.outcome.resourceId)
-          valid(suffix.length > 0 && suffix !== '..' && !suffix.startsWith('../') && !isAbsolute(suffix), 'created containment')
+          valid(suffix.length > 0 && suffix !== '..' && !suffix.startsWith('../') && !suffix.startsWith('..\\') && !isAbsolute(suffix), 'created containment')
         }
       }
     }
@@ -137,7 +137,7 @@ function validateFence(op) {
     else {
       valid(fence.basis === 'conservative-ancestor', 'scope basis')
       const suffix = relative(fence.ancestor, target.ancestor)
-      valid(suffix !== '..' && !suffix.startsWith('../') && !isAbsolute(suffix), 'conservative containment')
+      valid(suffix !== '..' && !suffix.startsWith('../') && !suffix.startsWith('..\\') && !isAbsolute(suffix), 'conservative containment')
     }
   } else {
     shape(fence, ['kind', 'basis'])

package/src/edit-lock/read-authority.js

@@ -72,8 +72,11 @@ export function readSnapshotBytes(authorityDir) {
       return { presence: 'no-snapshot' }
     }
     if (!leaf.isFile() || leaf.isSymbolicLink()) return { presence: 'not-a-file' }
-    if (!constants.O_NOFOLLOW) throw new Error('safe inspection unsupported on this platform')
-    fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK)
+    // Windows exposes no O_NOFOLLOW/O_NONBLOCK (constants undefined): the leaf
+    // lstat above already refused a symlink and the post-open fstat identity
+    // check below bounds the swap window (symlink creation needs privilege on
+    // Windows; the residual TOCTOU gap is documented in edit-lock.md).
+    fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0))
     const opened = fstatSync(fd)
     if (!opened.isFile() || !sameNode(leaf, opened)) throw new Error('opened snapshot identity changed')
     verifyPins(parents)

package/src/edit-lock/remote.js

@@ -7,17 +7,99 @@ import { createEditLockPeer } from './peer.js'
 import { serveEditLockPeer } from './peer-transport.js'
 import { createEditLockPeerClient } from './peer-client.js'
 
-/** Deterministic per-user endpoint for one canonical authority directory. The
- * OS temp directory is user-private on supported hosts; any same-user process
- * that can reach it is inside the cooperative trust boundary, not attested.
- * @param {string} directory */
-export function endpointFor(directory) {
+/** Deterministic per-user endpoint for one canonical authority directory. On
+ * POSIX hosts the OS temp directory is user-private and the endpoint is a
+ * domain-socket file; on Windows it is a named pipe (a kernel object with no
+ * filesystem node, so there is no stale-node sweep and no 100-byte path
+ * budget — only the 256-char pipe-name limit) whose name carries no
+ * backslashes beyond the \\.\pipe\ prefix (verified on Node v24). Any
+ * same-user process that can reach the endpoint is inside the cooperative
+ * trust boundary, not attested.
+ * @param {string} directory @param {string} [platform] */
+export function endpointFor(directory, platform = process.platform) {
   const authority = realpathSync.native(directory)
-  const path = join(tmpdir(), `weir-edit-lock-${createHash('sha256').update(authority).digest('hex').slice(0, 24)}.sock`)
+  const hash = createHash('sha256').update(authority).digest('hex').slice(0, 24)
+  if (platform === 'win32') return `\\\\.\\pipe\\weir-edit-lock-${hash}`
+  const path = join(tmpdir(), `weir-edit-lock-${hash}.sock`)
   if (Buffer.byteLength(path) > 100) throw new Error(`edit lock endpoint path too long: ${path}`)
   return path
 }
 
+/** True for Windows named-pipe endpoints: no filesystem node exists, so the
+ * stale-socket sweep and the close-time unlink are POSIX-only concerns.
+ * @param {string} endpoint */
+const namedPipe = endpoint => endpoint.startsWith('\\\\.\\pipe\\') || endpoint.startsWith('\\\\?\\pipe\\')
+
+/** Channel-open arbitration for one endpoint (duplicate-binding recovery,
+ * design D1/D2/D4). One sessionId has at most one registered channel at any
+ * moment:
+ *
+ * - a prior binding whose socket is PROVEN dead (synchronous state bits only:
+ *   `destroyed`, `closed` or `errored` — never an active probe) is reclaimed
+ *   through the SAME disconnect path a processed EOF takes (revoke + forget;
+ *   no lock is ever released), then the new open proceeds;
+ * - a prior binding that is alive — or whose state is in any way unclear — is
+ *   refused, fail-closed, and is never disconnected;
+ * - with no prior channel binding, a refusal from `lifecycle.start` itself
+ *   (a local agent or another mount generation holds the session) passes
+ *   through untouched: a local binding can never be preempted from here.
+ *
+ * Opens of one sessionId are serialized through a per-session promise queue,
+ * because the reclaim-check-register sequence awaits; different sessionIds
+ * stay fully concurrent. Exported for the unit tests; production wiring is
+ * the endpoint below. */
+export function createChannelBindingArbitration() {
+  /** @typedef {{destroyed?: boolean, closed?: boolean, errored?: unknown}} ChannelSocket */
+  /** @typedef {{disconnect: () => Promise<unknown>}} ChannelPeer */
+  /** @type {Map<string, {socket: ChannelSocket, peer: ChannelPeer}>} */
+  const bound = new Map()
+  /** @type {Map<string, Promise<unknown>>} */
+  const opening = new Map()
+  /** @param {string} sessionId
+   * @param {ChannelSocket} socket the NEW connection's socket
+   * @param {() => Promise<{peer: ChannelPeer}>} bind establish the channel
+   * (create the peer and start the lifecycle); its result is returned verbatim
+   * @returns {Promise<any>} */
+  function open(sessionId, socket, bind) {
+    const queued = opening.get(sessionId) ?? Promise.resolve()
+    const run = queued.then(step, step)
+    opening.set(sessionId, run)
+    const settled = () => { if (opening.get(sessionId) === run) opening.delete(sessionId) }
+    run.then(settled, settled)
+    return run
+    async function step() {
+      const prior = bound.get(sessionId)
+      if (prior) {
+        const dead = prior.socket.destroyed === true || prior.socket.closed === true || prior.socket.errored != null
+        if (!dead) throw new Error('session already bound')
+        try { await prior.peer.disconnect() } catch {
+          // Reclaim outcome unknown: stay fail-closed and KEEP the mapping, so
+          // the next open retries the reclaim instead of wedging behind a
+          // lifecycle-level refusal.
+          throw new Error('session already bound')
+        }
+        if (bound.get(sessionId) === prior) bound.delete(sessionId)
+      }
+      const established = await bind()
+      // Registered even when this socket already died during registration: the
+      // transport's own close handling still revokes it, and the next open
+      // reclaims the entry — a lost EOF can never wedge the session again.
+      bound.set(sessionId, { socket, peer: established.peer })
+      return established
+    }
+  }
+  /** Index hygiene on transport close: drop the entry only while it still
+   * names THIS connection's socket — a reclaimed binding must never be removed
+   * by the late close of the dead socket it replaced. Revocation itself runs
+   * on the transport's own disconnect path, not here.
+   * @param {string} sessionId @param {ChannelSocket} socket */
+  function release(sessionId, socket) {
+    const prior = bound.get(sessionId)
+    if (prior && prior.socket === socket) bound.delete(sessionId)
+  }
+  return Object.freeze({ open, release })
+}
+
 /** Publisher side: one session channel per connection. The first frame must be
  * `open {sessionId}`; the channel agent is fixed afterwards and EOF revokes it.
  * Call only while holding the publisher reservation (stale socket removal).
@@ -25,33 +107,46 @@ export function endpointFor(directory) {
  * @param {string} endpoint
  * @param {WeakMap<object, (event: unknown) => void>} sinks remote agent → notice sink */
 export async function serveEditLockEndpoint(lifecycle, endpoint, sinks) {
-  try {
-    if (!lstatSync(endpoint).isSocket()) throw new Error(`unexpected node at edit lock endpoint ${endpoint}`)
-    unlinkSync(endpoint)
-  } catch (error) { if (/** @type {any} */ (error)?.code !== 'ENOENT') throw error }
+  if (!namedPipe(endpoint)) {
+    try {
+      if (!lstatSync(endpoint).isSocket()) throw new Error(`unexpected node at edit lock endpoint ${endpoint}`)
+      unlinkSync(endpoint)
+    } catch (error) { if (/** @type {any} */ (error)?.code !== 'ENOENT') throw error }
+  }
   /** @type {Set<{close: () => Promise<unknown>}>} */
   const channels = new Set()
   let closed = false
+  const arbitration = createChannelBindingArbitration()
   const server = createServer(socket => {
     if (closed) { socket.destroy(); return }
     /** @type {ReturnType<typeof createEditLockPeer> | undefined} */
     let inner
+    /** @type {string | undefined} */
+    let openedSessionId
     const router = {
       /** @param {any} message */
       async receive(message) {
         if (inner) return inner.receive(message)
         const sessionId = message?.request?.sessionId
         if (message?.kind !== 'open' || typeof sessionId !== 'string' || !sessionId || sessionId.length > 256) throw new Error('channel must open a session first')
-        const agent = Object.freeze({ id: sessionId, remote: true })
-        sinks.set(agent, event => transport.notify(event))
-        inner = createEditLockPeer(lifecycle, agent)
-        return { state: await lifecycle.start(agent) }
+        openedSessionId = sessionId
+        const opened = await arbitration.open(sessionId, socket, async () => {
+          const agent = Object.freeze({ id: sessionId, remote: true })
+          sinks.set(agent, event => transport.notify(event))
+          inner = createEditLockPeer(lifecycle, agent)
+          const state = await lifecycle.start(agent)
+          return { peer: inner, state }
+        })
+        return { state: opened.state }
       },
       disconnect() { return inner ? inner.disconnect() : Promise.resolve() },
     }
     const transport = serveEditLockPeer(socket, router)
     channels.add(transport)
-    socket.once('close', () => channels.delete(transport))
+    socket.once('close', () => {
+      channels.delete(transport)
+      if (openedSessionId !== undefined) arbitration.release(openedSessionId, socket)
+    })
   })
   await new Promise((resolve, reject) => {
     server.once('error', reject)
@@ -63,7 +158,9 @@ export async function serveEditLockEndpoint(lifecycle, endpoint, sinks) {
       closed = true
       await new Promise(resolve => server.close(() => resolve(undefined)))
       const results = await Promise.allSettled([...channels].map(channel => channel.close()))
-      try { unlinkSync(endpoint) } catch { /* already gone */ }
+      if (!namedPipe(endpoint)) {
+        try { unlinkSync(endpoint) } catch { /* already gone */ }
+      }
       const errors = results.filter(result => result.status === 'rejected').map(result => /** @type {any} */ (result).reason)
       if (errors.length) throw new AggregateError(errors, 'edit lock endpoint revocation failed')
     },
@@ -83,14 +180,25 @@ export function createRemoteEditLockDomain(endpoint, hooks) {
   const all = new Set()
   const never = new AbortController().signal
   let closed = false
-  /** The publisher may not yet have processed an earlier channel's EOF; only
-   * channel establishment is retried, never a call.
+  /** Failure classes are split by WHERE the open failed, never by guessing at
+   * message text (design D3): a transport that never came up — or an open
+   * request that never got an answer — is an unreachable publisher and carries
+   * the reservation hint; an open the publisher answered and refused is a live
+   * publisher rejecting the binding, surfaced with its own guidance after the
+   * duplicate-binding retry budget runs out. Only that answered refusal is
+   * retried: the publisher may not yet have processed (or even seen) the
+   * earlier channel's death. Never a call.
    * @param {any} agent @returns {Promise<Channel>} */
   async function channelFor(agent) {
     for (let attempt = 0; ; attempt++) {
       try { return await openChannel(agent) } catch (error) {
-        if (attempt >= 20 || !/session already bound/.test(String(/** @type {any} */ (error)?.message))) throw error
-        await new Promise(resolve => setTimeout(resolve, 50))
+        if (/** @type {any} */ (error)?.answeredRefusal !== true) throw error
+        if (/session already bound/.test(String(/** @type {any} */ (error)?.message)) && attempt < 20) {
+          await new Promise(resolve => setTimeout(resolve, 50))
+          continue
+        }
+        const reason = String(/** @type {any} */ (error)?.message ?? error)
+        throw new Error(`edit lock duplicate session binding: session ${agent.id} is already active in the DeepSeek Harness window that publishes this project. Use the session in that window, close it there, or quit that Harness process. Do NOT remove the publisher reservation (.weir/.edit-lock.publisher-reservation) while that process is alive — the reservation belongs to it, and removing it would split the edit authority. (publisher answered: ${reason})`)
       }
     }
   }
@@ -108,17 +216,35 @@ export function createRemoteEditLockDomain(endpoint, hooks) {
     })
     channels.set(agent, channel)
     all.add(channel)
+    /** The publisher genuinely did not answer. @param {unknown} cause */
+    const unreachable = cause => new Error(`edit lock publisher unreachable at ${endpoint}: ${/** @type {any} */ (cause)?.message ?? cause}${hooks.unreachableHint ? `. ${hooks.unreachableHint}` : ''}`)
     channel.ready = (async () => {
-      await new Promise((resolve, reject) => {
-        socket.once('connect', resolve)
-        socket.once('error', reject)
-      })
-      const opened = await channel.client.request('open', 'open', { sessionId: agent.id }, never)
+      try {
+        await new Promise((resolve, reject) => {
+          socket.once('connect', resolve)
+          socket.once('error', reject)
+        })
+      } catch (error) {
+        // The transport never came up: the publisher process is not answering.
+        throw unreachable(error)
+      }
+      let opened
+      try {
+        opened = await channel.client.request('open', 'open', { sessionId: agent.id }, never)
+      } catch (error) {
+        const message = String(/** @type {any} */ (error)?.message ?? error)
+        // No answer ever arrived — the channel died mid-open or the request
+        // was never dispatched: the same failure class as a connect error.
+        if (message.startsWith('edit publication outcome UNKNOWN:') || message.startsWith('edit peer unavailable')) throw unreachable(error)
+        // The publisher answered and refused the open. channelFor owns the
+        // retry budget and the final message for answered refusals.
+        throw Object.assign(error instanceof Error ? error : new Error(message), { answeredRefusal: true })
+      }
       if (!channel.closed) channel.state = opened.state
     })()
     try { await channel.ready } catch (error) {
       channel.client.close()
-      throw new Error(`edit lock publisher unreachable at ${endpoint}: ${/** @type {any} */ (error)?.message ?? error}${hooks.unreachableHint ? `. ${hooks.unreachableHint}` : ''}`)
+      throw error
     }
     return channel
   }

package/src/edit-lock/reservation.js

@@ -48,8 +48,12 @@ function writeOwner(path, doc) {
   renameSync(temporary, join(path, OWNER_FILE))
 }
 
+// fsync on a directory handle is a POSIX crash-durability idiom: on Windows
+// the handle opens but fsync fails EPERM (verified on Node v24, NTFS), so the
+// win32 row skips it — the owner temp+rename stands on NTFS journaling.
 /** @param {string} directory */
 function syncParent(directory) {
+  if (process.platform !== 'darwin' && process.platform !== 'linux') return
   const handle = openSync(directory, constants.O_RDONLY | (constants.O_DIRECTORY ?? 0))
   try { fsyncSync(handle) } finally { closeSync(handle) }
 }

package/src/edit-lock/resource-identity.js

@@ -10,14 +10,23 @@ import { dirname, isAbsolute } from 'node:path'
  */
 
 /**
- * Read-only POSIX observations, not ownership or publication authority.
+ * Read-only filesystem observations, not ownership or publication authority.
  * Filesystem calls are not an atomic snapshot: callers must coordinate mutation.
  * dev/ino continuity cannot detect inode reuse or change-and-restore (ABA).
+ *
+ * Verified platform rows: darwin/linux (POSIX spellings) and win32
+ * (openspec windows-platform-adaptation: drive-letter absolute spellings with
+ * both separators normalized to '/'; NTFS dev/ino/nlink verified real on Node
+ * v24; junctions are reparse points and surface as symbolic links). UNC and
+ * device paths are rejected on win32 — network shares are outside the
+ * supported envelope (edit-lock.md).
+ * @param {{ platform?: string }} [options]
  */
-export function createResourceIdentity() {
-  if (process.platform !== 'darwin' && process.platform !== 'linux') {
-    throw new Error(`unsupported platform: ${process.platform}`)
+export function createResourceIdentity({ platform = process.platform } = {}) {
+  if (platform !== 'darwin' && platform !== 'linux' && platform !== 'win32') {
+    throw new Error(`unsupported platform: ${platform}`)
   }
+  const win = platform === 'win32'
   /** @type {WeakMap<object, Evidence>} */
   const observations = new WeakMap()
   /** @param {string} filePath @param {{ cwd: string }} options */
@@ -25,7 +34,8 @@ export function createResourceIdentity() {
     if (typeof cwd !== 'string' || !isAbsolute(cwd)) throw new TypeError('expected absolute cwd')
     if (typeof filePath !== 'string' || filePath.length === 0) throw new TypeError('expected non-empty path')
     if (filePath.includes('\0') || cwd.includes('\0')) throw new TypeError('NUL in path')
-    const result = inspect(isAbsolute(filePath) ? filePath : `${cwd}/${filePath}`)
+    const joined = isAbsolute(filePath) ? filePath : `${cwd}/${filePath}`
+    const result = inspect(win ? normalizeWin(joined) : joined, win)
     const observation = Object.freeze(result.value)
     observations.set(observation, { filePath, cwd, kind: observation.kind, witnesses: result.witnesses, links: result.links })
     return observation
@@ -48,11 +58,22 @@ export function createResourceIdentity() {
   }
 }
 
+/** Canonical spelling for the win32 walk: single forward slashes under a
+ * drive-letter root. UNC/device roots are rejected, never reinterpreted.
+ * @param {string} spelling */
+function normalizeWin(spelling) {
+  const normalized = spelling.replace(/\\/g, '/').replace(/\/{2,}/g, '/')
+  if (!/^[A-Za-z]:\//.test(normalized)) throw new Error(`unsupported path root (drive-letter absolute paths only): ${spelling.slice(0, 64)}`)
+  return normalized
+}
+
 /** Walk original prefixes without lexically collapsing symlink/.. or missing/..
- * @param {string} spelling @returns {Inspection} */
-function inspect(spelling) {
+ * The ancestor chain terminates at the filesystem root of the spelling —
+ * '/' on POSIX, '<drive>:/' on win32 — detected as dirname's fixed point.
+ * @param {string} spelling @param {boolean} win @returns {Inspection} */
+function inspect(spelling, win) {
   const parts = spelling.split('/')
-  let ancestor = '/'
+  let ancestor = win ? /** @type {string} */ (parts[0]) : '/'
   const witnesses = []
   let links = 0
   for (let index = 1; index < parts.length; index++) {
@@ -71,11 +92,11 @@ function inspect(spelling) {
     ancestor = realpathSync.native(prefix)
     const node = statSync(ancestor, { bigint: true })
     witnesses.push(`${ancestor}:${node.dev}:${node.ino}:${entry.dev}:${entry.ino}`)
-    if (entry.isSymbolicLink()) traceLink(physical, witnesses, 0)
+    if (entry.isSymbolicLink()) traceLink(physical, witnesses, 0, win)
     for (let parent = dirname(ancestor); ; parent = dirname(parent)) {
       const directory = statSync(parent, { bigint: true })
       witnesses.push(`${parent}:${directory.dev}:${directory.ino}`)
-      if (parent === '/') break
+      if (parent === dirname(parent)) break
     }
     if (index < parts.length - 1) {
       if (!node.isDirectory()) throw new Error('non-directory ancestor')
@@ -90,18 +111,20 @@ function inspect(spelling) {
  * the physical cursor avoids recursively replaying the original parent spelling.
  * Resolve each component only AFTER tracing it: lexical .. collapse or resolving
  * the whole target up front would hide nested links and their topology changes.
- * @param {string} path @param {string[]} witnesses @param {number} depth */
-function traceLink(path, witnesses, depth) {
+ * On win32 readlink returns backslash spellings; they are normalized before the
+ * walk so component splitting matches the POSIX row.
+ * @param {string} path @param {string[]} witnesses @param {number} depth @param {boolean} win */
+function traceLink(path, witnesses, depth, win) {
   if (depth >= 40) throw new Error('unsupported symlink depth')
-  const target = readlinkSync(path)
+  const target = win ? readlinkSync(path).replace(/\\/g, '/') : readlinkSync(path)
   witnesses.push(`link:${path}:${target}`)
-  let parent = isAbsolute(target) ? '/' : dirname(path)
+  let parent = isAbsolute(target) ? (win ? /** @type {string} */ (target.split('/')[0]) : '/') : dirname(path)
   const parts = isAbsolute(target) ? target.split('/').slice(1) : target.split('/')
   for (const part of parts) {
     const prefix = `${parent}/${part}`
     const node = lstatSync(prefix, { bigint: true })
     witnesses.push(`${prefix}:${node.dev}:${node.ino}`)
-    if (node.isSymbolicLink()) traceLink(prefix, witnesses, depth + 1)
+    if (node.isSymbolicLink()) traceLink(prefix, witnesses, depth + 1, win)
     parent = realpathSync.native(prefix)
   }
 }

package/src/edit-lock/runtime.js

@@ -17,6 +17,9 @@ async function writeAuthorityFile(directory, file, bytes) {
   const handle = await open(temporary, 'wx', 0o600)
   try { await handle.writeFile(bytes); await handle.sync() } finally { await handle.close() }
   await rename(temporary, join(directory, file))
+  // Directory fsync is POSIX-only (EPERM on win32): the file fsync above and
+  // the atomic rename stand alone there (reservation.js SYNC_SUPPORTED stance).
+  if (process.platform !== 'darwin' && process.platform !== 'linux') return
   const dir = await open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW)
   try { await dir.sync() } finally { await dir.close() }
 }

package/src/edit-lock/stale-sweep.js

@@ -3,6 +3,7 @@
 // the scheduler's job, clock and timer are injected so the composition and
 // the unit tests share one core.
 import { lstatSync } from 'node:fs'
+import { dirname } from 'node:path'
 
 /** Missing-target classification for one stored canonical resource id. ONLY
  * ENOENT counts: a successful lstat — including of a dangling symlink — is
@@ -16,7 +17,23 @@ export function isMissingTarget(resourceId) {
     lstatSync(resourceId)
     return false
   } catch (error) {
-    return /** @type {any} */ (error)?.code === 'ENOENT'
+    const code = /** @type {any} */ (error)?.code
+    if (code !== 'ENOENT') return false
+    // Windows reports a path through a regular-file component as ENOENT as
+    // well (there is no ENOTDIR): preserve the conservative POSIX
+    // classification by walking up — a non-directory ancestor means the path
+    // is BLOCKED (skip the row), not missing.
+    if (process.platform === 'win32') {
+      for (let parent = dirname(resourceId); parent !== dirname(parent); parent = dirname(parent)) {
+        let stat
+        try { stat = lstatSync(parent) } catch (ancestorError) {
+          if (/** @type {any} */ (ancestorError)?.code === 'ENOENT') continue
+          return false
+        }
+        return stat.isDirectory()
+      }
+    }
+    return true
   }
 }
 

package/src/edit-lock/store.js

@@ -6,6 +6,11 @@ import { validateOperationTransitions } from './operation-history.js'
 import { canonical, parseSnapshot, validateImage } from './snapshot.js'
 import { validateAdminTransition } from './admin-ledger.js'
 
+// Directory fsync is POSIX-only (EPERM on win32, Node v24 — same stance as
+// reservation.js SYNC_SUPPORTED): the win32 row persists with file fsync +
+// atomic rename and skips the directory sync steps.
+const DIR_SYNC_SUPPORTED = process.platform === 'darwin' || process.platform === 'linux'
+
 /**
  * Unmounted historical Edit Lock snapshot storage, NOT a kernel restore interface.
  * The caller MUST already hold an externally proven exclusive directory lifecycle
@@ -79,11 +84,14 @@ export async function openEditLockStore({ directory, domainId, mode, maxSnapshot
       await io('file-sync', async () => { await openedFile.sync() })
       await io('file-close', async () => { await openedFile.close(); file = undefined })
       await io('rename', async () => { renameStarted = true; await rename(temporary, target) })
-      await io('directory-open', async () => { dir = await open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW) })
-      valid(dir, 'opened directory descriptor')
+      // The directory steps fire on every platform — checkpoint cadence is a
+      // contract; only the real directory fsync is POSIX-only (EPERM on win32,
+      // same stance as reservation.js SYNC_SUPPORTED).
+      await io('directory-open', async () => { dir = DIR_SYNC_SUPPORTED ? await open(directory, constants.O_RDONLY | (constants.O_DIRECTORY ?? 0) | (constants.O_NOFOLLOW ?? 0)) : undefined })
+      if (DIR_SYNC_SUPPORTED) valid(dir, 'opened directory descriptor')
       const openedDirectory = dir
-      await io('directory-sync', async () => { await openedDirectory.sync() })
-      await io('directory-close', async () => { await openedDirectory.close(); dir = undefined })
+      await io('directory-sync', async () => { await openedDirectory?.sync() })
+      await io('directory-close', async () => { await openedDirectory?.close(); dir = undefined })
       committedBytes = Buffer.from(bytes, 'utf8')
     } catch (cause) {
       // Never remove/promote a temp or roll back a rename. Once rename was
@@ -108,7 +116,9 @@ export async function openEditLockStore({ directory, domainId, mode, maxSnapshot
     await persist(current)
   } else {
     valid((await lstat(target)).isFile(), 'snapshot must be regular file')
-    const file = await open(target, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK)
+    // win32: O_NOFOLLOW/O_NONBLOCK are undefined — the lstat above and the post-open
+    // stat below carry the identity checks (same stance as read-authority.js).
+    const file = await open(target, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0))
     try {
       valid((await file.stat()).isFile(), 'snapshot must be regular file')
       let bytes

package/src/worktree/pkgmgr.js

@@ -7,8 +7,12 @@
 // bundled npm only exists when the bundled Node directory actually contains
 // an `npm`; yarn and bun have no bundled offer. The returned command
 // prepends the resolved Node/bin directory to PATH so install lifecycle
-// scripts can spawn node, and `exec`s the manager so its exit code passes
-// straight through. User-CONFIGURED setup strings never enter this module.
+// scripts can spawn node, and hands the process over to the manager so its
+// exit code passes straight through. The command text matches the host
+// shell: POSIX sh (`export PATH=...; exec ...`) everywhere except win32,
+// where the host shell is PowerShell (`$env:PATH = ...; & ...; exit
+// $LASTEXITCODE`) — `export`/`exec` are not cmdlets and fail there.
+// User-CONFIGURED setup strings never enter this module.
 // Pure module (no ctx, no node: imports) — every fact arrives through seams.
 /** Install arguments per package manager (frozen-lockfile semantics kept). */
 export const MANAGER_INSTALL = Object.freeze({
@@ -42,10 +46,27 @@ export function quoteSh(word) {
   return `'${text.replace(/'/g, `'\\''`)}'`
 }
 
-/** POSIX dirname of a '/'-separated path. @param {string} path */
+/**
+ * Single-quote a word for PowerShell: a single-quoted PowerShell string has
+ * no escape semantics — the only special character inside is ' itself,
+ * doubled. Every word is wrapped (there is no safe-word pass-through).
+ * @param {string} word
+ */
+export function quotePs(word) {
+  return `'${String(word).replace(/'/g, `''`)}'`
+}
+
+/**
+ * dirname of a '/'- or '\'-separated path. POSIX edge semantics are kept
+ * (root is '/', no separator is '.'); a win32 drive root keeps its
+ * separator: dirOf('C:\\x') is 'C:\\', never 'C:'.
+ * @param {string} path
+ */
 function dirOf(path) {
-  const at = path.lastIndexOf('/')
-  return at > 0 ? path.slice(0, at) : at === 0 ? '/' : '.'
+  const at = Math.max(path.lastIndexOf('/'), path.lastIndexOf('\\'))
+  if (at <= 0) return at === 0 ? '/' : '.'
+  if (at === 2 && /^[A-Za-z]:/.test(path)) return path.slice(0, 3)
+  return path.slice(0, at)
 }
 
 /**
@@ -55,6 +76,7 @@ function dirOf(path) {
  * @property {(path: string) => boolean} isFile
  * @property {string | undefined} dshHome - the deployment's DSH home
  * @property {string} [home] - user home, used as `<home>/.dsh` when dshHome is unset
+ * @property {string} [platform] - host platform ('win32' switches the command form, dirname separators, and the bundled node file name); defaults to process.platform
  */
 
 /**
@@ -66,6 +88,10 @@ function dirOf(path) {
 export function resolveDerivedSetup(manager, seams) {
   const args = MANAGER_INSTALL[manager]
   if (!args) return { ok: false, manager }
+  // Defaulting to the HOST platform is the fail-safe choice: emitting POSIX
+  // text on a Windows host is exactly the failure this seam exists to
+  // prevent. Tests pin the platform explicitly.
+  const platform = seams.platform ?? process.platform
   const system = seams.foundOnPath(manager)
   if (system) {
     const node = seams.foundOnPath('node')
@@ -77,7 +103,7 @@ export function resolveDerivedSetup(manager, seams) {
         // Node's directory first: the manager's shim and every install
         // lifecycle script resolve node through PATH, and the manager's own
         // directory (e.g. ~/.npm-global/bin) need not contain one.
-        command: wrap([dirOf(node), dirOf(system)], [system, ...args]),
+        command: wrap([dirOf(node), dirOf(system)], [system, ...args], platform),
       }
     }
     // A manager whose interpreter is not on PATH cannot run either — fall
@@ -86,6 +112,8 @@ export function resolveDerivedSetup(manager, seams) {
   const offer = BUNDLED_OFFER[/** @type {'pnpm' | 'npm'} */ (manager)]
   const home = seams.dshHome ?? (seams.home ? `${seams.home}/.dsh` : undefined)
   if (offer && home) {
+    // The bundled Node executable carries the platform's file name.
+    const nodeRel = platform === 'win32' ? `${BUNDLED_REL.node}.exe` : BUNDLED_REL.node
     let runtimes = []
     try {
       runtimes = seams.listDirs(`${home}/dsh-runtimes`)
@@ -94,7 +122,7 @@ export function resolveDerivedSetup(manager, seams) {
     }
     for (const runtime of [...runtimes].sort()) {
       const root = `${home}/dsh-runtimes/${runtime}`
-      const node = `${root}/${BUNDLED_REL.node}`
+      const node = `${root}/${nodeRel}`
       const tool = `${root}/${offer}`
       if (!seams.isFile(node) || !seams.isFile(tool)) continue
       const argv = manager === 'pnpm' ? [node, tool, ...args] : [tool, ...args]
@@ -102,7 +130,7 @@ export function resolveDerivedSetup(manager, seams) {
         ok: true,
         source: 'bundled',
         display: argv.map((part) => (part === node ? 'node' : part)).join(' '),
-        command: wrap([`${root}/dependencies/node/bin`], argv),
+        command: wrap([`${root}/dependencies/node/bin`], argv, platform),
       }
     }
   }
@@ -118,8 +146,19 @@ export function setupMissingReason(manager) {
   return `setup needs ${manager}, but it was found neither on PATH nor in the DSH bundled runtime. Install ${manager} yourself, set "setup" in .weir/worktrees/.config.json, or skip with /worktree setup <lane> --skip`
 }
 
-/** @param {string[]} binDirs @param {string[]} argv */
-function wrap(binDirs, argv) {
+/**
+ * Build the derived setup command text for the host shell. POSIX keeps the
+ * sh form (`export PATH=...:"$PATH"; exec ...`) byte for byte. win32 targets
+ * PowerShell: the PATH prefix is one single-quoted ';'-joined string
+ * prepended to $env:PATH, the argv runs through the `&` call operator with
+ * every element single-quoted, and `exit $LASTEXITCODE` passes the manager's
+ * exit code through (the role `exec` plays on POSIX).
+ * @param {string[]} binDirs @param {string[]} argv @param {string} platform
+ */
+function wrap(binDirs, argv, platform) {
+  if (platform === 'win32') {
+    return `$env:PATH = ${quotePs(`${binDirs.join(';')};`)} + $env:PATH; & ${argv.map(quotePs).join(' ')}; exit $LASTEXITCODE`
+  }
   const path = binDirs.map(quoteSh).join(':')
   return `export PATH=${path}:"$PATH"; exec ${argv.map(quoteSh).join(' ')}`
 }

package/src/worktree/runner.js

@@ -102,10 +102,10 @@ export function createGitRunner(subprocess) {
  * manager first (the LSP module's extended resolver — S21), then the DSH
  * bundled runtime under the deployment's DSH home. Pure decision in
  * pkgmgr.js; this is only the seam wiring.
- * @param {{ subprocess: any, env?: Record<string, string | undefined>, home?: string, findExecutable?: (name: string) => Promise<string | undefined> }} options - `findExecutable` exists so tests can pin the lookup without fighting the host's real PATH scan
+ * @param {{ subprocess: any, env?: Record<string, string | undefined>, home?: string, findExecutable?: (name: string) => Promise<string | undefined>, platform?: string }} options - `findExecutable` exists so tests can pin the lookup without fighting the host's real PATH scan; `platform` defaults to process.platform and exists so tests can pin it
  * @returns {(manager: string) => Promise<ReturnType<typeof resolveDerivedSetup>>}
  */
-export function createSetupResolver({ subprocess, env = process.env, home = homedir(), findExecutable }) {
+export function createSetupResolver({ subprocess, env = process.env, home = homedir(), findExecutable, platform = process.platform }) {
   const find = findExecutable ?? ((name) => resolveExecutable(subprocess, name).catch(() => undefined))
   return async (manager) => {
     // Manager and node are resolved INDEPENDENTLY: the core asks the seam
@@ -130,6 +130,7 @@ export function createSetupResolver({ subprocess, env = process.env, home = home
       },
       dshHome: env.DSH_HOME,
       home,
+      platform,
     })
   }
 }