[1bye]

Phase 1 of #57 adds Windows app-control endpoints and private development files. This is the base for the supervisor and inspection PRs; their CLI gates remain until those layers. No control protocol, flags, JSON/status schema, exit codes or Unix session paths change.

Windows app hosts and standalone clients use local named pipes named from the runtime UUID, retaining .json advertisements and the existing local endpoint/path schema. The Windows default discovery directory is rake-control under the current user's temporary directory; RAKE_CONTROL_DIR retains its override. Nonblocking byte pipes use cooperative polling and bounded 16 KiB writes, preserving the 1 MiB newline frames, total client deadline, 32 connections and five-second server deadline. Cancellation drops handles without leaving a blocking worker or pending kernel I/O. Server replies remain alive until the client drains/closes within that deadline.

Security equivalence:

• Files and pipes get protected DACLs granting only the current user SID. Opened handles are checked for that owner and owner-only ACEs; null/public DACLs and non-disk files fail closed. Pipes use FIRST_PIPE_INSTANCE and REJECT_REMOTE_CLIENTS; clients reject remote/device names and use identification-only security quality of service.
• Reparse points are rejected on every filesystem component. Ancestor directory handles exclude delete sharing during final-object opens; checks and reads address the same handle. Final readers permit replacement. Windows 10+ FileRenameInfoEx POSIX replacement preserves active readers of the previous snapshot.
• Discovery, app advertisements, checkpoint restoration, development JSON markers, process-output readers and source-confinement adapters use the Windows boundary. Source files retain confinement without requiring private ACLs, matching Unix policy. Existing Unix UID/mode/no-follow operations remain unchanged.

Tests cover owner-only round trips and exclusive creation, public/null-DACL and junction refusal, canonical source confinement/escapes, private replacement with active readers, discovery, exclusive pipe binding, app endpoint dispatch/cleanup, request/reply limits, large bidirectional transfers and connection/read/write deadlines. Windows desktop CI runs the boundary tests before GPUI checks; existing workspace coverage is retained.

Validation at bd3d4c8: final CI run, including Windows desktop, passed all seven active jobs. Extended was skipped by its unchanged PR condition. This includes the follow-up regression for varying Unicode filename alignments and replacement with active readers. Rename storage includes the complete UTF-16 terminator while FileNameLength excludes it.

Mac: full CLI 355 passed, zero failed, two existing ignored with installed Python 3.14.4; headless app/client and real endpoint integration passed. App/client/CLI all-target Clippy with warnings denied, Cargo fmt, rake lint (730 files, 14 existing diagnostics, zero denied) and full spacing passed. Live isolated Fieldnotes desktop --cdp --no-open passed discovery/inspection, matching CDP identity, stateful reloads to generations 2/3 and Ctrl-C exit zero with empty discovery and zero owned processes remaining.

Verification limits: the actual Web --no-open --port 18081 invocation failed before startup because matching wasm-bindgen 0.2.129 is absent; no install was performed. Full Windows-target Clippy on the Mac stops in ring because Windows CRT headers are absent. An isolated Windows-boundary/test compilation passed Clippy; real Windows execution is established by the CI job above. Native Windows GUI inspection/source opening and dev supervision remain the next layers. Native Swift preview remains macOS-only.

Contracts/security details are in crates/rake-cli/PORTING.md. No live-checkout edits, main push, merges, force pushes, amendments/rebases, issue comments, labels or tool installations.

🤖 Generated with Claude Code