Epic: Windows campaign #430

devlore must write correctly on Windows. Go's os.Chmod toggles only the read-only attribute there,
so every restrictive mode this codebase requests is silently unenforced; a leading / with no volume is
drive-relative, so paths that look absolute are not; and a symlink an ordinary user cannot create sits in
the middle of the execution store's write path.

Plans of record: windows-native-permissions.md and
platform-test-matrix.md.

Features and tasks

#405 - Restrictive file modes unenforced: route every mutation through fsroot

• writ deploy/sops: route the decrypted-plaintext write through a root #433 - writ deploy/sops decrypted-plaintext write (phase 3.4)
• Route the remaining ~84 os.* sites through fsroot, by area #434 - the remaining ~84 os.* sites, by area (phase 4)
• Guard direct os.* mutations, and expose enforcement via IsRestricted / Observe.restricted #435 - the guard, plus IsRestricted / Observe.restricted (phase 5)
• devlore must not know its callers: shed writ's accessors from cmd/internal/devlore #436 - devlore sheds writ's accessors (LAST)
• writ: symlink deployment leaves SSH private keys 0644, which SSH refuses #382 - writ symlink deployment leaves SSH private keys 0644

#431 - Windows path resolution: every anchor resolves absolutely

• Unix-literal "/" roots panic on Windows: four test fixtures, and writ's System layer TargetRoot #392 - Unix-literal / roots panic on Windows; writ's System layer TargetRoot
• ConfigDirs and DataDirs return Unix paths on every platform, including Windows #437 - ConfigDirs / DataDirs return Unix paths on every platform

#432 - The execution store on Windows

• The store writes latest.yaml as a symlink an ordinary Windows user cannot create #438 - latest.yaml symlink, index ordering, cross-platform document identity

#373 - Run the full suite on every supported platform

• Starlark extension loading fails on Windows: paths interpolated into source break escape parsing #376 - Starlark extension loading fails on Windows
• Network-dependent tests make CI's red signal ambiguous #439 - network-dependent tests make CI's red signal ambiguous
• the 28 burn-down, filed by cluster as each is taken

#91 - Windows support statement

Already delivered

Phases 1, 2, 2b, 3.1 and 3.3a of the permissions plan: the fsroot API with Windows DACL enforcement,
session-owned filesystem access, the cmd/internal/cli migration (29 sites), op.SaveGraph /
op.SaveTrace, pkg/xdg as the single home resolver (step 54), and the self-install scenario running
real binaries on all three platforms. The private-key defect is fixed and proved by a DACL read-back on
a real Windows runner (#422).

The discipline

The windows test leg carries a known-failure baseline -- currently 28 -- verified name for name
against develop on every PR. It does not move until phase 5 (#435); a leg reporting anything else is a
regression to investigate, not a number to update.