docs: evaluate Windows recovery and Rust migration gates

[abruption]

Problem and result

The Rust/Windows experiments establish synthetic lock behavior, not native Windows recovery. This evaluation pins upstream Codex rust-v0.163.0 at 83086188ae0614bd882818ff1aa23f3194962012 and traces successful thread teardown through recorder ownership and guard drop, including failure branches where a shutdown notification does not prove lock release.

It distinguishes embedded, local-daemon and remote TUI targets; conditional daemon force termination; and thread release versus whole-process exit. The proposed direction retains the TypeScript CLI, defers a Rust helper pending native evidence, and does not recommend a full rewrite. W1–W7 describe the remaining file/SID/process/holder/cooperative-release/integrity/native-binary gates with consistent acceptance criteria. These are proposed follow-up units, not implemented support or a migration approval.

Refs #122. Keep it open until its remaining evaluation/follow-up requirements are resolved. Production code, dependencies, workflows, supported platforms, npm artifact and release behavior are unchanged. No Windows host or actual Codex process was used.

Validation and review

• npm ci, check, lint, test and package smoke passed. Suite: 266 total, 263 passed, three Linux-only skips, zero failures. The staged diff passes whitespace checks.
• The new source-only verifier passed against a shallow blobless clone: 17 pinned file hashes and 61 line anchors, zero failures. An independent GitHub API comparison also matched all 17/61. These checks verify source bytes/anchor text, not the document's causal interpretation or runtime lock release. Git may lazily fetch missing blobs; it is not an offline verifier.
• Initial independent read-only reviews ran in parallel on the shared READY-B/C input, SHA-256 4a920d54214ac5c35f15eff7de421445f10089f9bf608eaf0de29d6adfa90b78. Claude Code 2.1.301 requested and returned claude-opus-5-5; Codex CLI 0.163.0 used an isolated default selection, actual model unconfirmed. Both completed successfully without executing tests. Subsequent source cross-check and a separate read-only rereview confirmed the C corrections; the original CLI responses are not a certification of later edits.
• Corrections cover persistence-error/Arc limits, conditional TerminateProcess, TUI target selection, proposed versus adopted decisions, applicable W1–W7 gates, per-thread versus process-exit acceptance, and verifier limitations. Existing macOS opener-correlation limits remain disclosed.

This PR does not create follow-up issues, close #122, merge code, publish packages or authorize host-policy changes/native recovery experiments.

At d8e0ce15eaf77c6975c2336bfad5e2b63f1c7091, all 39 GitHub checks passed. Automatic Code Review and Security Review both completed without findings on that commit. This was the pre-merge validation observation.

Merged on 2026-10-18 as a9741298babdb96f79769effba5eeed6b703a145 following user approval, without protection bypass. #122/#127 remain open for their unresolved gates and policy decisions. No release or npm publication was performed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T12:51:28.557620Z	d8e0ce1	PR opened
🔒 Security Review	✅ Completed 2026-10-16T12:54:01.734311Z	d8e0ce1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.