research: W3 verify Windows process identity and execution mode #148

Purpose

Follow-up W3 from #122 and merged PR #144. The initial Rust feasibility evaluation is complete; this issue tracks one remaining evidence gate. Windows remains unsupported by the production CLI.

• Scope: one process handle per candidate. Identity is the handle plus
  GetProcessTimes creation time plus token SID, and liveness is
  WaitForSingleObject(h, 0), never STILL_ACTIVE. Covers revalidation of the
  same handle before any action, PID reuse, and classification of the image and
  command line as standalone TUI/exec, app-server, managed daemon or Remote
  Control, with every ambiguous case refused.
• Evidence: real-host records for live, start_mismatch and after_exit
  states, plus a deliberate PID-reuse attempt under a bounded budget, with a
  real Codex binary in a disposable CODEX_HOME for classification.
• Acceptance: identity changes and ambiguous modes yield unknown. Shared
  app-server, daemon and Remote Control owners are refused, matching the Unix
  contract.
• Existing coverage: fixture identity cases live, start_mismatch and
  after_exit matched at High integrity. There is no PID-reuse run and no real
  Codex classification. The upstream daemon uses the same handle and start-time
  pattern (windows.rs:196-253).

Delivery boundary

Use an isolated, unpublished research change with synthetic fixtures first. Record source/binary revisions, environment, hypotheses, actual outcomes and unverified conditions. Keep safeToUnlock=false; completing this gate alone does not authorize recovery or release. No production lock files, real user sessions, host policies or privileges are changed as part of this issue definition.

The proposed architecture keeps the TypeScript CLI. A Rust helper can be reconsidered after W1–W3 establish a concrete need; a full rewrite is deferred. W7 observations are prerequisites for the native classification portion of W3 and for W5; W6 must cover each integrity level claimed. W4 and W5 remain required for any automatic recovery design.

Priority: P3 research.
Milestone v0.4.7 is a planning target, not a Windows support or publication promise.

Source contract: Windows/Rust evaluation.