research: W6 compare Medium and High integrity observations #151

Purpose

Follow-up W6 from #122 and merged PR #144. The initial Rust feasibility evaluation is complete; this issue tracks one remaining evidence gate. Windows remains unsupported by the production CLI.

• Scope: rerun the E1, E3 and identity cases from a Medium-integrity
  interactive desktop session and compare with the High-integrity SSH results.
  Covers cross-integrity OpenProcess access (PROCESS_QUERY_LIMITED_INFORMATION
  and SYNCHRONIZE), Restart Manager visibility and UAC split tokens.
• Evidence: paired JSONL from the same commit at both levels, with the token
  integrity level recorded for every record. The run uses the host's existing
  execution policy and makes no host changes.
• Acceptance: any difference is explained, and an access failure maps to
  unknown. No conclusion is carried from one integrity level to the other.
• Existing coverage: High-integrity SSH runs only.

Delivery boundary

Use an isolated, unpublished research change with synthetic fixtures first. Record source/binary revisions, environment, hypotheses, actual outcomes and unverified conditions. Keep safeToUnlock=false; completing this gate alone does not authorize recovery or release. No production lock files, real user sessions, host policies or privileges are changed as part of this issue definition.

The proposed architecture keeps the TypeScript CLI. A Rust helper can be reconsidered after W1–W3 establish a concrete need; a full rewrite is deferred. W7 observations are prerequisites for the native classification portion of W3 and for W5; W6 must cover each integrity level claimed. W4 and W5 remain required for any automatic recovery design.

Priority: P3 research.
Milestone v0.4.7 is a planning target, not a Windows support or publication promise.

Source contract: Windows/Rust evaluation.