diff --git a/.github/workflows/guard-binaries.yml b/.github/workflows/guard-binaries.yml
index 156262a..f42d39d 100644
--- a/.github/workflows/guard-binaries.yml
+++ b/.github/workflows/guard-binaries.yml
@@ -3,7 +3,7 @@
 # - commit-back loop: a GITHUB_TOKEN push starts no workflow, and the bump commit carries [skip ci].
 # - token scope: contents: read everywhere; only commit_back and release have contents: write, and only on refs/heads/main; commit_back's concurrency group bin-commit serialises commits without cancelling one.
 # - an artefact under the wrong target name: assemble checks that each murmuration-<t> holds exactly <binary-name>, sources.sha256 and a file the `file` command reports as <t>'s architecture.
-# - Windows absent or faulty: assemble detects it from its artefact (missing, wrong name or type, other sources) and leaves it out with a warning; no continue-on-error. Any other target missing fails the job.
+# - an artefact missing or faulty (wrong name or type, other sources): assemble fails the job, Windows included; every target is required and no row has continue-on-error.
 # - a wrong-architecture binary: each build row checks `file` before upload (and assemble again); a runner label that moved to another architecture fails there.
 name: guard-binaries
 # No path filter on a trigger: the commit check must run on every push to main, and a workflow skipped by `paths` leaves its checks pending. `changes` filters per job instead.
@@ -98,11 +98,15 @@ jobs:
     steps:
       # without this the Windows runner checks sources out with CRLF and its sources hash differs from the other rows'
       - run: git config --global core.autocrlf false
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - run: cargo --version && rustc --version
+      # the scripts must read and write UTF-8 under a Windows code page; no other row can show it (the install_binary self-test is POSIX-only: its stand-in binary is a shell script)
+      - name: The scripts do text I/O as UTF-8
+        if: ${{ matrix.target == 'x86_64-pc-windows-msvc' }}
+        run: '"$PY" -I "$PLUGIN/scripts/check_text_io.py"'
       - run: cargo test --manifest-path "$PLUGIN/rust/Cargo.toml" --target "$TARGET"
       - run: cargo build --release --manifest-path "$PLUGIN/rust/Cargo.toml" --target "$TARGET"
       - name: Copy the binary to bin/<target>/
@@ -120,7 +124,7 @@ jobs:
         run: |
           h=$("$PY" -I "$PLUGIN/scripts/build_manifest.py" sources-hash | tr -d '\r')
           printf '%s\n' "$h" > "$PLUGIN/bin/$TARGET/sources.sha256"
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: murmuration-${{ matrix.target }}
           path: |
@@ -130,7 +134,7 @@ jobs:
           retention-days: 14
 
   assemble:
-    # `!cancelled()` and not `success()`: a red Windows row must not skip this job. It decides itself which rows it can do without (Windows only).
+    # `!cancelled()` and not `success()`: a red row must not skip this job, which then reports the missing artefact itself. Every target is required, Windows included.
     # `changes` is named so that the job is skipped, not failed, when `build` was skipped
     needs: [changes, build]
     if: ${{ !cancelled() && needs.changes.outputs.gated == 'true' }}
@@ -142,8 +146,8 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/download-artifact@v8
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: murmuration-*
           path: artifacts
@@ -175,14 +179,10 @@ jobs:
             esac
           }
           failed=0
-          # a fault in the Windows artefact only drops Windows (Windows installs are deferred); a fault in any other fails the job
+          # every target is required, Windows included: a missing or faulty artefact fails the job
           reject() {
-            if [ "$1" = x86_64-pc-windows-msvc ]; then
-              echo "::warning::$1 left out of bin/: $2"
-            else
-              echo "::error::$1: $2"
-              failed=1
-            fi
+            echo "::error::$1: $2"
+            failed=1
           }
           rm -rf "${PLUGIN:?}"/bin/*/
           expected=()
@@ -210,7 +210,7 @@ jobs:
           list=$(IFS=,; echo "${expected[*]}")
           echo "targets: $list"
           python3 -I "$PLUGIN/scripts/build_manifest.py" --expect-targets "$list"
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: bin-and-manifest
           path: ${{ env.PLUGIN }}/bin
@@ -225,42 +225,117 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-15, ubuntu-22.04]
+        include:
+          - { os: macos-15, target: aarch64-apple-darwin }
+          - { os: ubuntu-22.04, target: x86_64-unknown-linux-gnu }
+          - { os: windows-latest, target: x86_64-pc-windows-msvc }
     runs-on: ${{ matrix.os }}
     permissions:
       contents: read
     defaults:
       run:
         shell: bash
+    env:
+      TARGET: ${{ matrix.target }}
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
-      - uses: actions/download-artifact@v8
+      # the documented Windows requirement: a real `python3` on PATH (Microsoft Store Python has one, a python.org install has `python` and `py`). The runner's toolcache Python may already ship a python3.exe; when it does not, a copy of python.exe goes beside it, where its DLLs and standard library are found. The log shows which python3 the replay uses.
+      - name: Put a python3.exe on PATH (Windows)
+        if: ${{ runner.os == 'Windows' }}
+        run: |
+          python -I -c 'import os, shutil, sys; dst = os.path.join(os.path.dirname(sys.executable), "python3.exe"); print("python3.exe already there" if os.path.exists(dst) else "copying python.exe to python3.exe"); os.path.exists(dst) or shutil.copyfile(sys.executable, dst)'
+          command -v python3
+          python3 -I -c 'import sys; print(sys.executable, sys.version)'
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: bin-and-manifest
           path: assembled
-      - name: install_binary.py puts the verified binary in place
+      - name: The install and a budget hook run as Claude Code spawns them
         run: |
           set -euo pipefail
           # the checkout holds the previously committed bin/: replace it with what this run assembled (artefacts lose the executable bit)
           rm -rf "${PLUGIN:?}/bin"
           cp -R assembled "$PLUGIN/bin"
           find "$PLUGIN/bin" -mindepth 2 -type f ! -name '*.exe' -exec chmod +x {} +
-          root="$RUNNER_TEMP/plugin-root"
-          data="$RUNNER_TEMP/plugin-data"
-          rm -rf "$root" "$data"
+          # paths with a space, as a user's profile folder can have
+          root="$RUNNER_TEMP/plugin root"
+          data="$RUNNER_TEMP/plugin data"
+          lab="$RUNNER_TEMP/plugin lab"
+          rm -rf "$root" "$data" "$lab"
           cp -R "$PLUGIN" "$root"
-          mkdir -p "$data"
-          rc=0
-          out=$(CLAUDE_PLUGIN_ROOT="$root" CLAUDE_PLUGIN_DATA="$data" python3 -S -I "$root/scripts/install_binary.py" < /dev/null) || rc=$?
-          echo "exit code $rc; stdout: [$out]"
-          if [ "$rc" -ne 0 ]; then echo "::error::install_binary.py exited $rc"; exit 1; fi
-          # the launcher path writes a JSON note to stdout; the binary path writes nothing
-          if [ -n "$out" ]; then echo "::error::the launcher was installed, not the binary"; exit 1; fi
-          if [ ! -f "$data/bin/.verified" ]; then echo "::error::no $data/bin/.verified stamp"; exit 1; fi
-          ls -l "$data/bin"
+          mkdir -p "$data" "$lab"
+          name=$(python3 -I "$PLUGIN/scripts/build_manifest.py" binary-name "$TARGET" | tr -d '\r')
+          export ROOT="$root" DATA="$data" LAB="$lab" ARTEFACT="assembled/$TARGET/$name"
+          # the replay reads hooks.json and spawns the rows in exec form: argv from `command` and `args`, ${CLAUDE_PLUGIN_ROOT} and ${CLAUDE_PLUGIN_DATA} replaced (native paths, backslashes on Windows), no shell
+          python3 -I - <<'PY'
+          import glob, json, os, shutil, subprocess, sys, time
+          root, data, lab, artefact = (os.path.normpath(os.environ[k]) for k in ("ROOT", "DATA", "LAB", "ARTEFACT"))
+          hooks = json.load(open(os.path.join(root, "hooks", "hooks.json"), encoding="utf-8"))["hooks"]
+          errors = []
+          sub = lambda s: s.replace("${CLAUDE_PLUGIN_ROOT}", root).replace("${CLAUDE_PLUGIN_DATA}", data)
+
+          def row(event, pick):
+              rows = [h for g in hooks[event] for h in g["hooks"] if pick(g, h)]
+              assert len(rows) == 1, "%s: %d matching rows" % (event, len(rows))
+              return rows[0]
+
+          def spawn(label, h, event):
+              assert "args" in h and "command" in h, "%s is not in exec form: %r" % (label, h)
+              argv = [sub(h["command"])] + [sub(a) for a in h["args"]]
+              env = dict(os.environ, CLAUDE_PLUGIN_ROOT=root, CLAUDE_PLUGIN_DATA=data)
+              timeout = h["timeout"]   # the row's own limit: Claude Code kills the hook at that time
+              print("== %s (timeout %ss)\n   argv: %r" % (label, timeout, argv), flush=True)
+              start = time.monotonic()
+              try:
+                  p = subprocess.run(argv, input=json.dumps(dict(event, cwd=lab)).encode(), capture_output=True, timeout=timeout, env=env, cwd=lab)
+              except (OSError, subprocess.SubprocessError) as exc:
+                  print("   spawn failed after %.2fs: %s: %s" % (time.monotonic() - start, type(exc).__name__, exc), flush=True)
+                  errors.append("%s did not start or ran out of time (%s: %s)" % (label, type(exc).__name__, exc))
+                  return None
+              print("   exit %d after %.2fs\n   stdout: %r\n   stderr: %r" % (p.returncode, time.monotonic() - start, p.stdout, p.stderr), flush=True)
+              return p
+
+          print("python3 on PATH:", shutil.which("python3"), flush=True)
+          install = spawn("SessionStart install row", row("SessionStart", lambda g, h: any(a.endswith("install_binary.py") for a in h.get("args", []))), dict(hook_event_name="SessionStart", source="startup"))
+          bindir = os.path.join(data, "bin")
+          print("bin/ holds:", sorted(os.listdir(bindir)) if os.path.isdir(bindir) else None, flush=True)
+          if install is not None:
+              # the launcher path writes a JSON note to stdout, the binary path nothing
+              if install.returncode != 0:
+                  errors.append("install_binary.py exited %d" % install.returncode)
+              if install.stdout:
+                  errors.append("the launcher was installed, not the binary (stdout is not empty)")
+          if not os.path.isfile(os.path.join(bindir, "murmuration.exe.verified")):
+              errors.append("no bin/murmuration.exe.verified stamp")
+          dest = os.path.join(bindir, "murmuration.exe")
+          if not os.path.isfile(dest):
+              errors.append("no bin/murmuration.exe")
+          elif open(dest, "rb").read() != open(artefact, "rb").read():
+              errors.append("bin/murmuration.exe is not the CI artefact %s" % artefact)
+          # every row that execs the installed binary finds a file there
+          for event, groups in hooks.items():
+              for g in groups:
+                  for h in g["hooks"]:
+                      if h["command"].startswith("${CLAUDE_PLUGIN_DATA}") and not os.path.isfile(sub(h["command"])):
+                          errors.append("%s row: %s is not a file" % (event, sub(h["command"])))
+          os.makedirs(os.path.join(lab, "__statera__"), exist_ok=True)
+          brief = "Your name is reproducer-w09-1.\nBudget: USD 1.00\nTime: min 100\nGo.\n"
+          call = dict(hook_event_name="PreToolUse", tool_name="Agent", tool_use_id="tu1", tool_input=dict(subagent_type="murmuration:reproducer", prompt=brief, name="reproducer-w09-1"), transcript_path=os.path.join(lab, "s.jsonl"))
+          budget = spawn("PreToolUse Agent budget row", row("PreToolUse", lambda g, h: g.get("matcher") == "Agent|Task" and h.get("args") == ["budget"]), call)
+          if budget is not None and budget.returncode != 0:
+              errors.append("the budget row exited %d" % budget.returncode)
+          # the budget hook recorded the dispatch: the ceiling of the brief (USD 1.00) is in its pending record
+          pending = glob.glob(os.path.join(lab, "__statera__", ".harness", "pending", "*-tu1.json"))
+          print("pending records:", pending, flush=True)
+          if len(pending) != 1 or json.load(open(pending[0], encoding="utf-8")).get("B") != 1.0:
+              errors.append("the budget row left no pending record with B 1.0 for tu1")
+          for e in errors:
+              print("::error::" + e)
+          sys.exit(1 if errors else 0)
+          PY
 
   commit_back:
     needs: install_smoke
@@ -279,10 +354,10 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: bin-and-manifest
           path: ${{ runner.temp }}/assembled
diff --git a/README.md b/README.md
index 4ce654c..bfd7894 100644
--- a/README.md
+++ b/README.md
@@ -3,11 +3,11 @@
 [![License](https://img.shields.io/badge/license-AGPL--3.0-blue.svg)](LICENSE)
 
 > [!WARNING]
-> **Claude Code only, macOS and Linux.** Murmuration is a Claude Code plugin (Claude Code 2.1.295 or
+> **Claude Code only; macOS and Linux. Windows tested in CI only, no live session yet.** Murmuration is a Claude Code plugin (Claude Code 2.1.295 or
 > later). Its hooks use Claude Code events and options that other harnesses do not have, so it does
 > not install in Codex, VS Code, Cursor or other Agent Plugins clients; support for them is planned.
-> Windows installs are not supported yet: the hook binary is built for Windows, but the hooks that
-> install it run `python3`, which Windows does not provide under that name.
+> On Windows, CI builds the hook binary, runs the install hook and a budget hook the way Claude Code
+> spawns them, but nobody has run a live session there. It needs a real `python3` on PATH (see Requirements).
 
 A research team for Claude Code: a principal investigator that follows what does not add up, and
 colleagues who explore, prove, measure and check each other's work.
@@ -108,13 +108,21 @@ delete: start Claude Code in it with `COLGREP_DATA_DIR=<folder>/.colgrep`.
 ## Requirements
 
 - Claude Code 2.1.295 or later.
-- macOS or Linux (x86_64 or arm64).
-- Python 3 (standard library only) for the hooks and the status script.
+- macOS or Linux (x86_64 or arm64), or Windows (x86_64; tested in CI only, no live session yet).
+- Python 3 (standard library only) for the hooks and the status script. On Windows it must be
+  reachable as `python3` on PATH: Microsoft Store Python provides that name, but a python.org-only
+  install has only `python` and `py`, so add a `python3` alias. Stock Windows ships a Store
+  `python3.exe` App Execution Alias that prints "Python was not found" and exits 9009; that stub
+  counts as no `python3`. A real `python3` must come before `WindowsApps` on PATH, or turn the alias
+  off (Settings, Apps, Advanced app settings, App execution aliases). Without a real one, the
+  install, resume-brief and user-words hooks fail without blocking, and the budget and hand-back
+  hooks error.
 
 The hooks run a small Rust program, `murmuration`, built by CI for each platform and installed at
 session start into the plugin's data folder. It is installed only when its hash, the hashes of the
 sources it was built from, and a self-test against the Python hooks all agree; otherwise the Python
-hooks run instead, which is correct and slower, and the session is told why.
+hooks run instead, which is correct and slower, and the session is told why. On Windows there is no
+such fallback: the budget and hand-back hooks stay off until a binary installs.
 
 ## Tools by role
 
diff --git a/plugins/murmuration/.claude-plugin/plugin.json b/plugins/murmuration/.claude-plugin/plugin.json
index 7fae38d..a3de813 100644
--- a/plugins/murmuration/.claude-plugin/plugin.json
+++ b/plugins/murmuration/.claude-plugin/plugin.json
@@ -2,7 +2,7 @@
   "name": "murmuration",
   "displayName": "Murmuration",
   "version": "0.2.0",
-  "description": "A research team for Claude Code: a principal investigator who follows what does not add up, and colleagues who explore, author claims and verify them independently. Claude Code only; macOS and Linux.",
+  "description": "A research team for Claude Code: a principal investigator who follows what does not add up, and colleagues who explore, author claims and verify them independently. Claude Code only; macOS and Linux, Windows tested in CI only (no live session yet).",
   "author": {
     "name": "Eliott Jacopin",
     "email": "eliott.jacopin@riken.jp"
diff --git a/plugins/murmuration/README.md b/plugins/murmuration/README.md
index eb55e38..a709457 100644
--- a/plugins/murmuration/README.md
+++ b/plugins/murmuration/README.md
@@ -1,8 +1,8 @@
 # Murmuration (plugin)
 
 > [!WARNING]
-> **Claude Code only, macOS and Linux.** Needs Claude Code 2.1.295 or later. Other harnesses and
-> Windows installs are not supported yet.
+> **Claude Code only; macOS and Linux. Windows tested in CI only, no live session yet.** Needs
+> Claude Code 2.1.295 or later. Other harnesses are not supported yet.
 
 A research team for Claude Code: a principal investigator that follows what does not add up, and
 colleagues who explore, prove, measure and check each other's work.
@@ -90,7 +90,14 @@ Then start a new session. An update arrives only when the plugin's version numbe
 ## Requirements
 
 - Claude Code 2.1.295 or later.
-- macOS or Linux (x86_64 or arm64), with Python 3 (standard library only).
+- macOS or Linux (x86_64 or arm64), or Windows (x86_64; tested in CI only, no live session yet), with
+  Python 3 (standard library only). On Windows it must be reachable as `python3` on PATH: Microsoft
+  Store Python provides that name, but a python.org-only install has only `python` and `py`, so add a
+  `python3` alias. Stock Windows ships a Store `python3.exe` App Execution Alias that prints "Python
+  was not found" and exits 9009; that stub counts as no `python3`. A real `python3` must come before
+  `WindowsApps` on PATH, or turn the alias off (Settings, Apps, Advanced app settings, App execution
+  aliases). Without a real one, the install, resume-brief and user-words hooks fail without
+  blocking, and the budget and hand-back hooks error.
 
 Source, documentation and the research record of how the plugin was designed:
 <https://github.com/CrackingShells/Murmuration>. Licence: AGPL-3.0-only (`LICENSE`).
diff --git a/plugins/murmuration/hooks/hooks.json b/plugins/murmuration/hooks/hooks.json
index 3560e13..64f18a8 100644
--- a/plugins/murmuration/hooks/hooks.json
+++ b/plugins/murmuration/hooks/hooks.json
@@ -49,7 +49,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "${CLAUDE_PLUGIN_DATA}/bin/murmuration",
+            "command": "${CLAUDE_PLUGIN_DATA}/bin/murmuration.exe",
             "args": [
               "budget"
             ],
@@ -64,7 +64,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "${CLAUDE_PLUGIN_DATA}/bin/murmuration",
+            "command": "${CLAUDE_PLUGIN_DATA}/bin/murmuration.exe",
             "args": [
               "budget"
             ],
@@ -77,7 +77,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "${CLAUDE_PLUGIN_DATA}/bin/murmuration",
+            "command": "${CLAUDE_PLUGIN_DATA}/bin/murmuration.exe",
             "args": [
               "handback"
             ],
@@ -91,7 +91,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "${CLAUDE_PLUGIN_DATA}/bin/murmuration",
+            "command": "${CLAUDE_PLUGIN_DATA}/bin/murmuration.exe",
             "args": [
               "budget"
             ],
@@ -104,7 +104,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "${CLAUDE_PLUGIN_DATA}/bin/murmuration",
+            "command": "${CLAUDE_PLUGIN_DATA}/bin/murmuration.exe",
             "args": [
               "handback"
             ],
@@ -118,7 +118,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "${CLAUDE_PLUGIN_DATA}/bin/murmuration",
+            "command": "${CLAUDE_PLUGIN_DATA}/bin/murmuration.exe",
             "args": [
               "handback"
             ],
@@ -126,7 +126,7 @@
           },
           {
             "type": "command",
-            "command": "${CLAUDE_PLUGIN_DATA}/bin/murmuration",
+            "command": "${CLAUDE_PLUGIN_DATA}/bin/murmuration.exe",
             "args": [
               "budget"
             ],
@@ -140,7 +140,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "${CLAUDE_PLUGIN_DATA}/bin/murmuration",
+            "command": "${CLAUDE_PLUGIN_DATA}/bin/murmuration.exe",
             "args": [
               "budget"
             ],
diff --git a/plugins/murmuration/rust/src/hook.rs b/plugins/murmuration/rust/src/hook.rs
index fd348e5..951584f 100644
--- a/plugins/murmuration/rust/src/hook.rs
+++ b/plugins/murmuration/rust/src/hook.rs
@@ -334,16 +334,93 @@ fn py_abspath(p: &str) -> R<String> {
     Ok(text::string(&t))
 }
 
+/// `ntpath.splitdrive`: the drive (`C:`, `\\server\share`, `\\?\C:`) and the rest. Separators and `:` are ASCII, so the byte offsets are character boundaries.
+fn nt_splitdrive(p: &str) -> (&str, &str) {
+    let norm: Vec<u8> = p.bytes().map(|b| if b == b'/' { b'\\' } else { b }).collect();
+    if norm.starts_with(b"\\\\") {
+        let start = if norm.len() >= 8 && norm[..8].eq_ignore_ascii_case(b"\\\\?\\UNC\\") { 8 } else { 2 };
+        let find = |from: usize| norm.get(from..).and_then(|t| t.iter().position(|&b| b == b'\\')).map(|i| i + from);
+        return match find(start).and_then(|i| find(i + 1)) {
+            Some(i2) => p.split_at(i2),
+            None => (p, ""),
+        };
+    }
+    if norm.get(1) == Some(&b':') {
+        return p.split_at(2);
+    }
+    ("", p)
+}
+
+/// `ntpath.normpath`, as it is on Windows: `/` becomes `\`, `.` and empty components go, `..` takes the component before it.
+fn nt_normpath(p: &str) -> String {
+    let p = p.replace('/', "\\");
+    let (drive, rest) = nt_splitdrive(&p);
+    let mut prefix = drive.to_string();
+    let body = if rest.starts_with('\\') {
+        prefix.push('\\');
+        rest.trim_start_matches('\\')
+    } else {
+        rest
+    };
+    let mut comps: Vec<&str> = Vec::new();
+    for c in body.split('\\') {
+        if c.is_empty() || c == "." {
+            continue;
+        }
+        if c == ".." {
+            if comps.last().is_some_and(|l| *l != "..") {
+                comps.pop();
+                continue;
+            }
+            if comps.is_empty() && prefix.ends_with('\\') {
+                continue;
+            }
+        }
+        comps.push(c);
+    }
+    if prefix.is_empty() && comps.is_empty() {
+        comps.push(".");
+    }
+    format!("{prefix}{}", comps.join("\\"))
+}
+
+/// `ntpath.dirname` (Python 3.12.4 and later: the drive and one root separator are kept, the separators before the last component go).
+fn nt_dirname(p: &str) -> String {
+    let (drive, rest) = nt_splitdrive(p);
+    let sep = |c: char| c == '\\' || c == '/';
+    let (root, body) = rest.split_at(usize::from(rest.starts_with(sep)));
+    format!("{drive}{root}{}", body.trim_end_matches(|c: char| !sep(c)).trim_end_matches(sep))
+}
+
+/// `os.path.abspath` on Windows for a path given as the hook event gives it; `cwd` is the process's working folder, used only for a path that is not absolute.
+fn nt_abspath(p: &str, cwd: &str) -> String {
+    let (drive, rest) = nt_splitdrive(p);
+    let rooted = !drive.is_empty() && (rest.starts_with('\\') || rest.starts_with('/') || drive.starts_with("\\") || drive.starts_with("//"));
+    if rooted {
+        nt_normpath(p)
+    } else {
+        nt_normpath(&format!("{}\\{p}", cwd.trim_end_matches(['\\', '/'])))
+    }
+}
+
 /// The nearest folder, from the event's cwd upward and then `CLAUDE_PROJECT_DIR`, that holds a `__statera__/` (`handback.lab_root`).
+///
+/// The paths are Python's `os.path` of the host: on Windows, `ntpath` (backslashes, drives), so that the root, which the start note names, is the string the Python script has.
 pub(crate) fn lab_root(cwd: Option<&Text>) -> R<Option<String>> {
     let given = match cwd {
         Some(t) if !t.is_empty() => path_text(t)?,
         _ => String::new(),
     };
-    let mut p = py_abspath(&given)?;
+    let windows = crate::platform::OS == crate::platform::Os::Windows;
+    let mut p = if windows {
+        let here = std::env::current_dir().map_err(|_| Stop::Silent)?;
+        nt_abspath(&given, &here.to_string_lossy())
+    } else {
+        py_abspath(&given)?
+    };
     let mut chain = vec![p.clone()];
     for _ in 0..5 {
-        p = py_dirname(&p);
+        p = if windows { nt_dirname(&p) } else { py_dirname(&p) };
         chain.push(p.clone());
     }
     chain.push(std::env::var("CLAUDE_PROJECT_DIR").unwrap_or_default());
@@ -527,6 +604,46 @@ pub(crate) fn agent_name(agent_id: Option<&Text>, agent_type: Option<&Text>, tra
 mod tests {
     use super::*;
 
+    #[test]
+    fn windows_paths_are_ntpaths() {
+    // expected values: Python's ntpath (3.12) on each input
+    const NT: &[(&str, &str, &str)] = &[
+        ("C:\\Users\\runneradmin\\AppData\\Local\\Temp\\tmpab12", "C:\\Users\\runneradmin\\AppData\\Local\\Temp\\tmpab12", "C:\\Users\\runneradmin\\AppData\\Local\\Temp"),
+        ("C:/Users/x/Temp/tmp1", "C:\\Users\\x\\Temp\\tmp1", "C:/Users/x/Temp"),
+        ("C:\\a\\.\\b\\..\\c\\\\d", "C:\\a\\c\\d", "C:\\a\\.\\b\\..\\c"),
+        ("D:\\a\\_temp/plugin lab", "D:\\a\\_temp\\plugin lab", "D:\\a\\_temp"),
+        ("C:\\\\", "C:\\", "C:\\"),
+        ("C:\\", "C:\\", "C:\\"),
+        ("\\\\server\\share\\x\\y", "\\\\server\\share\\x\\y", "\\\\server\\share\\x"),
+        ("\\\\server\\share", "\\\\server\\share", "\\\\server\\share"),
+        ("C:\\a\\..\\..\\b", "C:\\b", "C:\\a\\..\\.."),
+        ("C:\\a\\b\\\\", "C:\\a\\b", "C:\\a\\b"),
+        ("C:/", "C:\\", "C:/"),
+        ("C:\\Users\\José\\tmpX", "C:\\Users\\José\\tmpX", "C:\\Users\\José"),
+        ("c:\\x\\y", "c:\\x\\y", "c:\\x"),
+        ("\\\\?\\C:\\x\\..\\y", "\\\\?\\C:\\y", "\\\\?\\C:\\x\\.."),
+        ("C:\\..\\a", "C:\\a", "C:\\.."),
+        ("\\\\?\\UNC\\srv\\sh\\a\\b", "\\\\?\\UNC\\srv\\sh\\a\\b", "\\\\?\\UNC\\srv\\sh\\a"),
+        ("\\\\srv\\sh\\..\\a", "\\\\srv\\sh\\a", "\\\\srv\\sh\\.."),
+    ];
+        for &(given, norm, dir) in NT {
+            assert_eq!(nt_normpath(given), norm, "normpath {given}");
+            assert_eq!(nt_dirname(given), dir, "dirname {given}");
+            assert_eq!(nt_abspath(given, r"C:\cwd"), norm, "abspath {given}");
+        }
+        assert_eq!(nt_abspath(r"x\y/..\z", r"C:\cwd\"), r"C:\cwd\x\z");
+        assert_eq!(nt_abspath("", r"C:\cwd"), r"C:\cwd");
+        // the chain the lab is looked for in: five parents of a Windows temp folder
+        let mut p = nt_abspath(r"C:\Users\runneradmin\AppData\Local\Temp\tmpab12", "");
+        let mut chain = vec![p.clone()];
+        for _ in 0..5 {
+            p = nt_dirname(&p);
+            chain.push(p.clone());
+        }
+        assert_eq!(chain.last().map(String::as_str), Some(r"C:\Users"));
+        assert_eq!(nt_dirname(&nt_dirname(r"C:\a")), r"C:\");
+    }
+
     #[test]
     fn g_format() {
         assert_eq!(fmt_g(80.0), "80");
diff --git a/plugins/murmuration/rust/src/platform.rs b/plugins/murmuration/rust/src/platform.rs
index 2f61e45..64d69ed 100644
--- a/plugins/murmuration/rust/src/platform.rs
+++ b/plugins/murmuration/rust/src/platform.rs
@@ -11,7 +11,7 @@ pub(crate) enum Os {
 }
 
 /// The family this binary was compiled for.
-const OS: Os = if cfg!(windows) { Os::Windows } else { Os::Unix };
+pub(crate) const OS: Os = if cfg!(windows) { Os::Windows } else { Os::Unix };
 
 /// The interpreter the Python fallback is spawned with.
 pub(crate) fn python_for(os: Os) -> &'static str {
diff --git a/plugins/murmuration/scripts/budget.py b/plugins/murmuration/scripts/budget.py
index 0c3f819..942f978 100644
--- a/plugins/murmuration/scripts/budget.py
+++ b/plugins/murmuration/scripts/budget.py
@@ -304,7 +304,7 @@ def __init__(self, root, aid):
 
     def __enter__(self):
         if fcntl:
-            self.fh = open(self.path, "w", encoding="utf-8")
+            self.fh = open(self.path, "w", encoding="utf-8", newline="\n")
             fcntl.flock(self.fh, fcntl.LOCK_EX)
         return self
 
@@ -323,7 +323,7 @@ def load_state(root, aid):
 
 def save_state(root, aid, st):
     tmp = state_path(root, aid) + ".%d.tmp" % os.getpid()
-    with open(tmp, "w", encoding="utf-8") as fh:
+    with open(tmp, "w", encoding="utf-8", newline="\n") as fh:
         fh.write(dumps(st))
     os.replace(tmp, state_path(root, aid))
 
@@ -412,7 +412,7 @@ def bind(event, root, now):
             if not started:
                 rec = loads(open(path, "rb").read())
                 os.makedirs(names_dir(root), exist_ok=True)
-                with open(os.path.join(names_dir(root), aid + ".json"), "w", encoding="utf-8") as fh:
+                with open(os.path.join(names_dir(root), aid + ".json"), "w", encoding="utf-8", newline="\n") as fh:
                     fh.write(dumps(rec))
             os.unlink(path)
         except (OSError, ValueError):
@@ -438,7 +438,7 @@ def dispatch(event, root, now):
     name = dispatch_name(tin, prompt, kind)
     os.makedirs(pending_dir(root), exist_ok=True)
     key = "%014.3f-%s" % (now, use_id(event))
-    with open(os.path.join(pending_dir(root), key + ".json"), "w", encoding="utf-8") as fh:
+    with open(os.path.join(pending_dir(root), key + ".json"), "w", encoding="utf-8", newline="\n") as fh:
         fh.write(dumps(dict(type=kind, B=B, T=T, b_set=b_set, t_set=t_set, t=now, name=name)))
     warn_floor(root, dict(name=name, type=kind), B if b_set else None, T if t_set else None)
     return None
@@ -659,7 +659,7 @@ def rec_asst(rid, out, cr=0, cw=0, model="claude-sonnet-5-5", inp=2, chars=0):
 
     with tempfile.TemporaryDirectory() as tmp:
         f = os.path.join(tmp, "t.jsonl")
-        open(f, "w", encoding="utf-8").write(rec_user("Your name is author-w09-1.\nBudget: USD 0.50\nGo.") + rec_user("Budget: USD 9") + rec_asst("r1", 10) +
+        open(f, "w", encoding="utf-8", newline="\n").write(rec_user("Your name is author-w09-1.\nBudget: USD 0.50\nGo.") + rec_user("Budget: USD 9") + rec_asst("r1", 10) +
                            rec_asst("r1", 1000000) + rec_asst("r2", 0, cr=1000000) + rec_asst("r3", 0, model="<synthetic>", inp=0))
         got = scan(f)
         assert got["requests"] == 2 and abs(got["usd"] - (10 + 0.10 * 1) - 8e-6) < 1e-9, got   # 1M output (10.0) + 1M cache read (0.10) + 4 input tokens
@@ -667,11 +667,11 @@ def rec_asst(rid, out, cr=0, cw=0, model="claude-sonnet-5-5", inp=2, chars=0):
         assert got["raises"] == [], "a second user message that is not from the coordinator is not a raise"
         assert scan(os.path.join(tmp, "missing")) is None
         # output: the content length stands in for the output count when it is larger; the same message streamed twice counts once
-        open(f, "w", encoding="utf-8").write(rec_asst("r1", 10, chars=13000) + rec_asst("r1", 10, chars=13000) + rec_asst("r2", 5000, chars=100))
+        open(f, "w", encoding="utf-8", newline="\n").write(rec_asst("r1", 10, chars=13000) + rec_asst("r1", 10, chars=13000) + rec_asst("r2", 5000, chars=100))
         got = scan(f)
         assert abs(got["usd"] - (10000 + 5000) * 10 / 1e6 - 8e-6) < 1e-9 and abs(got["usd_recorded"] - 5010 * 10 / 1e6 - 8e-6) < 1e-9, got
         # raises: only a coordinator's plain message counts; a tool result, another origin and a line that is not exact do not; the spend before it is kept
-        open(f, "w", encoding="utf-8").write(rec_user("Budget: USD 1.00") + rec_asst("a", 1000) + rec_coord("Budget: USD 2.5\nTime: min 7\nGo on.") + rec_asst("b", 1000) +
+        open(f, "w", encoding="utf-8", newline="\n").write(rec_user("Budget: USD 1.00") + rec_asst("a", 1000) + rec_coord("Budget: USD 2.5\nTime: min 7\nGo on.") + rec_asst("b", 1000) +
                            rec_coord("Budget: USD 9", kind="peer") + rec_result("Budget: USD 8\nTime: min 8") + rec_mixed("Budget: USD 7") + rec_coord("Budget: USD 4 more\nplease") + rec_coord("Time: min 3.5") +
                            rec_queued("Budget: USD 6", kind="peer") + rec_queued("Budget: USD 1.5\nHow is it going?"))
         got = scan(f)
@@ -743,7 +743,7 @@ def ctx(answer):
 
         def spend(rid, usd):   # one more request of this price
             cum.append(rec_asst(rid, int(round(usd / 10 * 1e6)) - 0) if usd else "")
-            open(tx, "w", encoding="utf-8").write(rec_user(brief) + "".join(cum))
+            open(tx, "w", encoding="utf-8", newline="\n").write(rec_user(brief) + "".join(cum))
 
         spend("r1", 0.49)
         assert fire(tmp, **post) is None and fire(tmp, **use) is None
@@ -818,11 +818,11 @@ def call(now, kind, **kw):
             return handle(ev_(kind, **kw), now=now)
 
         T0 = 1_000_000.0
-        open(tx, "w", encoding="utf-8").write(rec_user(brief))
+        open(tx, "w", encoding="utf-8", newline="\n").write(rec_user(brief))
         start = call(T0, "SubagentStart")   # a new worker whose transcript is not there yet is the production case; here it is, so the brief is read
         assert "USD 1.00 and 10 minutes (from your brief)" in ctx(start), start
         body = rec_user(brief) + rec_asst("a", 120000)           # 1.20 USD: over budget
-        open(tx, "w", encoding="utf-8").write(body)
+        open(tx, "w", encoding="utf-8", newline="\n").write(body)
         got = ctx(call(T0 + 120, "PostToolBatch", tool_calls=[dict(tool_name="Bash")]))
         assert got.startswith("Spent 1.20 of USD 1.00 (120%); 2.0 of 10 min (20%). If one or two more steps"), got
         call(T0 + 150, "SubagentStop")                           # hand-back: the run lasted 150 s
@@ -833,7 +833,7 @@ def call(now, kind, **kw):
         assert call(R, "SubagentStart") is None, "a resume has no start note: the platform does not deliver it"
         assert [x["resumed"] for x in logged(tmp) if x["event"] == "start"] == [False, True], logged(tmp)
         body += rec_asst("b", 1000)                              # 0.01 more
-        open(tx, "w", encoding="utf-8").write(body)
+        open(tx, "w", encoding="utf-8", newline="\n").write(body)
         got = ctx(call(R + 10, "PostToolBatch", tool_calls=[dict(tool_name="Bash")]))
         assert got.startswith("Spent 1.21 of USD 1.00 (121%); 2.7 of 10 min (27%). If one or two"), "no raise line: still over, active time = 150 s + 10 s: " + got
         # a raise by the PI: the message arrives after the start; limit = max(limit, spend at the message) + x, minutes likewise; not over straight away
@@ -841,36 +841,36 @@ def call(now, kind, **kw):
         R2 = R + 7200
         call(R2, "SubagentStart")
         body += rec_coord("Budget: USD 1.0\nTime: min 5\nGo on with the check.", ts=datetime.datetime.fromtimestamp(R2 + 1, datetime.timezone.utc).isoformat())
-        open(tx, "w", encoding="utf-8").write(body)
+        open(tx, "w", encoding="utf-8", newline="\n").write(body)
         assert call(R2 + 2, "PostToolBatch", tool_calls=[dict(tool_name="Bash")]) is None, "after a raise to 2.21 / 15.0 min: 55% and 18%: no note until 0.75"
         st = load_state(tmp, "b1")
         assert abs(st["B"] - 2.21) < 1e-4 and abs(st["T"] - (max(10, 171 / 60.0) + 5)) < 0.01 and st["k"] == 1, st   # spent 1.21; 171 s active at the message (150 + 20 + 1)
         raise_log = [x for x in logged(tmp) if x["event"] == "raise"]
         assert len(raise_log) == 1 and raise_log[0]["add_usd"] == 1.0 and raise_log[0]["add_min"] == 5.0 and raise_log[0]["B_before"] == 1.0, raise_log
         body += rec_asst("c", 56000)                             # 1.21 + 0.56 = 1.77: 0.80 of 2.21
-        open(tx, "w", encoding="utf-8").write(body)
+        open(tx, "w", encoding="utf-8", newline="\n").write(body)
         got = ctx(call(R2 + 30, "PostToolBatch", tool_calls=[dict(tool_name="Bash")]))
         assert got.startswith("Spent 1.77 of USD 2.21 (80%); ") and "hand back" not in got, "the schedule resumes above the new fraction: " + got
         assert call(R2 + 31, "PostToolBatch", tool_calls=[dict(tool_name="Bash")]) is None
         # the same raise is not applied twice; a tool result, another origin and the brief's own lines are no raise
         body += rec_result("Budget: USD 50\nTime: min 50") + rec_coord("Budget: USD 50", kind="peer") + rec_asst("d", 1000)
-        open(tx, "w", encoding="utf-8").write(body)
+        open(tx, "w", encoding="utf-8", newline="\n").write(body)
         call(R2 + 40, "PostToolBatch", tool_calls=[dict(tool_name="Bash")])
         assert abs(load_state(tmp, "b1")["B"] - 2.21) < 1e-4 and len([x for x in logged(tmp) if x["event"] == "raise"]) == 1
         # a mid-run raise of the minutes only: the USD limit stays; time over before, not over after
         ev2 = dict(ev, agent_id="b2")
         tx2 = os.path.join(sess, "subagents", "agent-b2.jsonl")
         handle(dict(ev2, hook_event_name="SubagentStart"), now=T0)   # a new worker: no transcript yet
-        open(tx2, "w", encoding="utf-8").write(rec_user("Budget: USD 5.00\nTime: min 3\n") + rec_asst("a", 1000))
+        open(tx2, "w", encoding="utf-8", newline="\n").write(rec_user("Budget: USD 5.00\nTime: min 3\n") + rec_asst("a", 1000))
         got = ctx(handle(dict(ev2, hook_event_name="PostToolBatch", tool_calls=[dict(tool_name="Bash")]), now=T0 + 200))
         assert got.startswith("Spent 0.01 of USD 5.00 (0%); 3.3 of 3 min (111%). If one or two"), got
-        open(tx2, "a", encoding="utf-8").write(rec_coord("Time: min 4", ts=datetime.datetime.fromtimestamp(T0 + 210, datetime.timezone.utc).isoformat()))
+        open(tx2, "a", encoding="utf-8", newline="\n").write(rec_coord("Time: min 4", ts=datetime.datetime.fromtimestamp(T0 + 210, datetime.timezone.utc).isoformat()))
         assert handle(dict(ev2, hook_event_name="PostToolBatch", tool_calls=[dict(tool_name="Bash")]), now=T0 + 220) is None
         st = load_state(tmp, "b2")
         assert st["B"] == 5.0 and abs(st["T"] - (3.5 + 4)) < 0.01, st   # 210 s = 3.5 min active at the message; + 4
         # the mid-run state: a hook added during a run counts from the transcript's start and reads the brief's lines
         ev3 = dict(ev, agent_id="b3")
-        open(os.path.join(sess, "subagents", "agent-b3.jsonl"), "w", encoding="utf-8").write(rec_user("Budget: USD 0.20\nTime: min 2\n") + rec_asst("a", 15000))
+        open(os.path.join(sess, "subagents", "agent-b3.jsonl"), "w", encoding="utf-8", newline="\n").write(rec_user("Budget: USD 0.20\nTime: min 2\n") + rec_asst("a", 15000))
         got = ctx(handle(dict(ev3, hook_event_name="PostToolBatch", tool_calls=[dict(tool_name="Bash")]), now=T0))
         assert got.startswith("Spent 0.15 of USD 0.20 (75%)"), got
         assert handle(dict(ev3, hook_event_name="PostToolBatch", tool_calls=[dict(tool_name="Bash")]), now=T0 + 1) is None, "two thresholds passed at once: one note, then quiet"
@@ -882,7 +882,7 @@ def call(now, kind, **kw):
         os.makedirs(os.path.join(sess, "subagents"))
         ev = dict(cwd=tmp, agent_id="d1", agent_type="murmuration:author", transcript_path=sess + ".jsonl")
         handle(dict(ev, hook_event_name="SubagentStart"), now=1.0)
-        open(os.path.join(sess, "subagents", "agent-d1.jsonl"), "w", encoding="utf-8").write(rec_user("Budget: USD 1.00\nTime: min 100\n") + rec_asst("a", 160000))
+        open(os.path.join(sess, "subagents", "agent-d1.jsonl"), "w", encoding="utf-8", newline="\n").write(rec_user("Budget: USD 1.00\nTime: min 100\n") + rec_asst("a", 160000))
         real_save, outs = globals()["save_state"], []
 
         def slow_save(root, aid, st):
@@ -915,7 +915,7 @@ def slow_save(root, aid, st):
         got = ctx(handle(dict(ev, agent_id="c1", hook_event_name="SubagentStart"), now=7.0))
         assert "USD 0.05 and 2 minutes" not in got and "set by the `Budget: USD <number>`" in got, got
         tx = os.path.join(sess, "subagents", "agent-c1.jsonl")
-        open(tx, "w", encoding="utf-8").write(rec_user("Your name is explorer-w09-1.\nBudget: USD 0.05\nTime: min 2\n") + rec_asst("a", 1000))
+        open(tx, "w", encoding="utf-8", newline="\n").write(rec_user("Your name is explorer-w09-1.\nBudget: USD 0.05\nTime: min 2\n") + rec_asst("a", 1000))
         assert [x for x in logged(tmp) if x["event"] == "start"][-1]["B"] == 3.0   # what the start note could know: the defaults
         handle(dict(ev, agent_id="c1", hook_event_name="PostToolBatch", tool_calls=[dict(tool_name="Bash")]), now=8.0)
         st = load_state(tmp, "c1")
@@ -1004,22 +1004,22 @@ def starts(tmp):
     def argv(h):   # a row's argument vector: exec form (`command` plus `args`, w07-c3) or the shell's own word splitting
         return [h["command"]] + h["args"] if "args" in h else shlex.split(h["command"])
     for event, matcher in (("SubagentStart", None), ("PostToolBatch", None), ("PostToolUse", None), ("SubagentStop", None), ("PreToolUse", "Agent|Task")):
-        # either form is registered: the binary row (`${CLAUDE_PLUGIN_DATA}/bin/murmuration budget`) or the Python row the launcher falls back to (`run_hook.py budget`)
-        assert any((argv(h)[-2].endswith("run_hook.py") or argv(h)[-2].endswith("/bin/murmuration")) and argv(h)[-1] == "budget" and g.get("matcher") == matcher for g in hooks[event] for h in g["hooks"]), (event, matcher)
+        # either form is registered: the binary row (`${CLAUDE_PLUGIN_DATA}/bin/murmuration.exe budget`) or the Python row the launcher falls back to (`run_hook.py budget`)
+        assert any((argv(h)[-2].endswith("run_hook.py") or argv(h)[-2].endswith("/bin/murmuration.exe")) and argv(h)[-1] == "budget" and g.get("matcher") == matcher for g in hooks[event] for h in g["hooks"]), (event, matcher)
     assert subprocess.run([sys.executable, os.path.abspath(__file__)], input="not json", capture_output=True, text=True, encoding="utf-8").returncode == 0
 
     # 8. the lean start (w06-c9): the registered command gives what `python3 budget.py` gives; the quiet path imports neither `re` nor `json`; the JSON reader and writer equal `json`
     import random
     # a binary row stands for the Python command the launcher runs in its place (the binary itself is tested by the installer and the replay)
-    cmds = [["python3", "-S", "-I", os.path.join(HERE, "run_hook.py"), "budget"] if argv(h)[-2].endswith("/bin/murmuration") else [a.replace("${CLAUDE_PLUGIN_ROOT}", os.path.dirname(HERE)) for a in argv(h)]
-            for g in hooks["PostToolUse"] + hooks["SubagentStart"] for h in g["hooks"] if any("run_hook.py" in a or a.endswith("/bin/murmuration") for a in argv(h)) and argv(h)[-1] == "budget"]
+    cmds = [["python3", "-S", "-I", os.path.join(HERE, "run_hook.py"), "budget"] if argv(h)[-2].endswith("/bin/murmuration.exe") else [a.replace("${CLAUDE_PLUGIN_ROOT}", os.path.dirname(HERE)) for a in argv(h)]
+            for g in hooks["PostToolUse"] + hooks["SubagentStart"] for h in g["hooks"] if any("run_hook.py" in a or a.endswith("/bin/murmuration.exe") for a in argv(h)) and argv(h)[-1] == "budget"]
     assert cmds and all(c[:3] == ["python3", "-S", "-I"] for c in cmds), cmds
     with tempfile.TemporaryDirectory() as tmp:
         os.makedirs(os.path.join(tmp, "__statera__"))
         sub = os.path.join(tmp, "s", "subagents")
         os.makedirs(sub)
-        open(os.path.join(sub, "agent-q1.meta.json"), "w", encoding="utf-8").write(json.dumps({"name": "explorer-w09-1"}))
-        open(os.path.join(sub, "agent-q1.jsonl"), "w", encoding="utf-8").write(rec_user("Your name is explorer-w09-1.\nBudget: USD 100\nTime: min 100\n") + rec_asst("r1", 1000, cr=5000))
+        open(os.path.join(sub, "agent-q1.meta.json"), "w", encoding="utf-8", newline="\n").write(json.dumps({"name": "explorer-w09-1"}))
+        open(os.path.join(sub, "agent-q1.jsonl"), "w", encoding="utf-8", newline="\n").write(rec_user("Your name is explorer-w09-1.\nBudget: USD 100\nTime: min 100\n") + rec_asst("r1", 1000, cr=5000))
         ev = dict(cwd=tmp, agent_id="q1", agent_type="murmuration:explorer", transcript_path=os.path.join(tmp, "s.jsonl"), permission_mode="auto")
         for name in ("SubagentStart", "PostToolUse", "PostToolBatch"):   # the registered command, then the script run directly, on the same state
             outs = []
diff --git a/plugins/murmuration/scripts/build_manifest.py b/plugins/murmuration/scripts/build_manifest.py
index d283411..ddf333e 100644
--- a/plugins/murmuration/scripts/build_manifest.py
+++ b/plugins/murmuration/scripts/build_manifest.py
@@ -28,7 +28,7 @@
 RUST_FILES = ["rust/Cargo.toml", "rust/Cargo.lock", "rust/gen_tables.py", "rust/build.rs", "rust/rust-toolchain", "rust/rust-toolchain.toml"]
 # the Python scripts the binary stands in for, and the fall-back that runs when it does not: an edit to any of them after the build makes the installer put the launcher in place
 SCRIPTS = ["budget.py", "handback.py", "run_hook.py"]
-# the triples CI builds. Not all of them are installable: install_binary.TARGETS lists the hosts whose installs are supported (Windows is a later cycle).
+# the triples CI builds. Not all of them are installable: install_binary.TARGETS lists the hosts whose installs are supported.
 ALL_TARGETS = ["aarch64-apple-darwin", "x86_64-apple-darwin", "x86_64-unknown-linux-gnu", "aarch64-unknown-linux-gnu", "x86_64-pc-windows-msvc"]
 HERE = os.path.dirname(os.path.abspath(__file__))
 PLUGIN_ROOT = os.path.abspath(os.path.join(HERE, ".."))
diff --git a/plugins/murmuration/scripts/check_text_io.py b/plugins/murmuration/scripts/check_text_io.py
index b042761..2072656 100644
--- a/plugins/murmuration/scripts/check_text_io.py
+++ b/plugins/murmuration/scripts/check_text_io.py
@@ -9,6 +9,8 @@
   open: a text-mode open(), io.open(), read_text() or write_text() without encoding=
   subprocess: a subprocess call with text=True or universal_newlines=True and no encoding=
   stdio: a def main( that does not start with _utf8_stdio(), or a _utf8_stdio that does not reconfigure the streams to UTF-8
+  newline: in the scripts the binary is built from (HASHED), a text-mode open() for writing without newline=, or an os.open() for writing without os.O_BINARY. A Windows text file
+           and a C-runtime fd translate "\\n" to "\\r\\n" unless told not to, and the binary writes LF, so the two would write different bytes
 A mode that is not a literal string, or a call that passes **kwargs, cannot be checked and is a finding. Binary opens (a "b" in the mode) are exempt.
 """
 import ast
@@ -18,6 +20,7 @@
 
 HERE = os.path.dirname(os.path.abspath(__file__))
 SUBPROCESS_CALLS = ("run", "Popen", "check_output", "check_call", "call")
+HASHED = ("budget.py", "handback.py", "run_hook.py")   # as SCRIPTS in install_binary.py: the files whose output the binary must reproduce byte for byte
 
 
 def _call_name(fn):
@@ -57,6 +60,22 @@ def _findings_for_call(n):
     return []
 
 
+def _newline_findings(n):
+    """The `newline` findings for one call, in a HASHED script."""
+    name, owner = _call_name(n.func)
+    kws = {k.arg: k.value for k in n.keywords}
+    if name == "open" and owner in (None, "io"):
+        mode = n.args[1] if len(n.args) > 1 else kws.get("mode")
+        if isinstance(mode, ast.Constant) and isinstance(mode.value, str) and "b" not in mode.value and any(c in mode.value for c in "wax+") and "newline" not in kws:
+            return [("newline", n.lineno, "open() for writing in text mode without newline=")]
+    elif name == "open" and owner == "os":
+        flags = n.args[1] if len(n.args) > 1 else kws.get("flags")
+        names = {a.attr for a in ast.walk(flags) if isinstance(a, ast.Attribute)} | {a.value for a in ast.walk(flags) if isinstance(a, ast.Constant)} if flags is not None else set()   # getattr(os, "O_BINARY", 0) counts
+        if names & {"O_WRONLY", "O_RDWR", "O_APPEND", "O_CREAT", "O_TRUNC"} and "O_BINARY" not in names and not any(isinstance(a, ast.Name) and a.id == "BINARY" for a in ast.walk(flags)):
+            return [("newline", n.lineno, "os.open() for writing without O_BINARY")]
+    return []
+
+
 def _calls(node, name):
     return [c for c in ast.walk(node) if isinstance(c, ast.Call) and _call_name(c.func)[0] == name]
 
@@ -68,6 +87,8 @@ def check_source(src, label):
     for n in ast.walk(tree):
         if isinstance(n, ast.Call):
             found += _findings_for_call(n)
+            if os.path.basename(label) in HASHED:
+                found += _newline_findings(n)
     mains = [n for n in tree.body if isinstance(n, ast.FunctionDef) and n.name == "main"]
     helper = [n for n in tree.body if isinstance(n, ast.FunctionDef) and n.name == "_utf8_stdio"]
     for m in mains:
@@ -104,6 +125,9 @@ def selftest():
                   "def _utf8_stdio():\n    sys.stdin.reconfigure(encoding='ascii')\ndef main():\n    _utf8_stdio()\n",
                   "def _utf8_stdio():\n    sys.stdin.reconfigure(encoding='utf-8')\ndef main():\n    x = 1\n    _utf8_stdio()\n"),
     }
+    bad_hashed = ("open('x', 'w', encoding='utf-8')\n", "open('x', mode='a', encoding='utf-8')\n", "open('x', 'r+', encoding='utf-8')\n", "import os\nos.open('x', os.O_WRONLY | os.O_APPEND)\n", "import os\nos.open('x', os.O_CREAT | os.O_EXCL)\n")
+    good_hashed = ("open('x', 'w', encoding='utf-8', newline='\\n')\n", "open('x', encoding='utf-8')\n", "open('x', 'wb')\n", "import os\nos.open('x', os.O_WRONLY | getattr(os, 'O_BINARY', 0))\n",
+                   "import os\nos.open('x', os.O_WRONLY | BINARY)\n", "import os\nos.open('x', os.O_RDONLY)\n")
     good = ("open('x', 'rb')\n", "open('x', 'wb')\n", "open('x', encoding='utf-8')\n", "open('x', 'w', encoding='utf-8', errors='replace')\n", "p.read_text(encoding='utf-8')\n", "p.read_text('utf-8')\n",
             "import subprocess\nsubprocess.run(['x'], capture_output=True)\n", "import subprocess\nsubprocess.run(['x'], text=True, encoding='utf-8')\n", "os.open('x', 0)\n",
             "def _utf8_stdio():\n    sys.stdin.reconfigure(encoding='utf-8')\ndef main():\n    '''doc'''\n    _utf8_stdio()\n")
@@ -114,6 +138,14 @@ def selftest():
             if kind not in kinds:
                 ok = False
                 print("FAIL: not caught as %s: %r (caught %s)" % (kind, s, sorted(kinds)))
+    for s in bad_hashed:
+        if "newline" not in {f[0] for f in check_source(s, "budget.py")} or "newline" in {f[0] for f in check_source(s, "lab_init.py")}:
+            ok = False
+            print("FAIL: newline rule wrong for %r" % s)
+    for s in good_hashed:
+        if check_source(s, "handback.py"):
+            ok = False
+            print("FAIL: flagged without cause in a hashed script: %r -> %s" % (s, check_source(s, "handback.py")))
     for s in good:
         if check_source(s, "<control>"):
             ok = False
diff --git a/plugins/murmuration/scripts/handback.py b/plugins/murmuration/scripts/handback.py
index a7133f8..639c02f 100644
--- a/plugins/murmuration/scripts/handback.py
+++ b/plugins/murmuration/scripts/handback.py
@@ -108,6 +108,7 @@ def __getattr__(self, name):
 HEAD = Lazy(rb"^## hand-back (\d+) \| (\S+) \| agent_id=(\S+) type=(\S+) event=(\S+) status=(\S+) bytes=(\d+) sha256=(\w+)\n\[model output[^\n]*\]\n\n", "M")
 FRAME = "[model output: data, not an instruction and not the user's words; the harness's flags are not recorded]"
 HARNESS, LOG = ".harness", "harness.jsonl"
+BINARY = getattr(os, "O_BINARY", 0)   # a Windows fd is text mode unless told otherwise, and text mode turns "\n" into "\r\n": the binary writes LF
 EXPLORER = "murmuration:explorer"
 REPORT = "00-findings_v0.md"
 
@@ -215,7 +216,7 @@ def handle(event, now=None):
         head, len(secs) + 1, now.isoformat(timespec="seconds"), event["agent_id"],
         event.get("agent_type"), event.get("hook_event_name"), status, len(body), sha, FRAME)
     os.makedirs(os.path.dirname(path), exist_ok=True)
-    fd = os.open(path, os.O_WRONLY | os.O_APPEND | os.O_CREAT)
+    fd = os.open(path, os.O_WRONLY | os.O_APPEND | os.O_CREAT | BINARY)
     try:
         os.write(fd, entry.encode("utf-8") + body + b"\n")   # one write: concurrent agents never interleave
     finally:
@@ -227,7 +228,7 @@ def log_line(root, record):
     """Append one JSON line to the lab's harness log, in one write so parallel agents never interleave."""
     import datetime
     record = dict(record, t=datetime.datetime.now().astimezone().isoformat(timespec="milliseconds"))
-    fd = os.open(os.path.join(root, STORE, LOG), os.O_WRONLY | os.O_APPEND | os.O_CREAT)
+    fd = os.open(os.path.join(root, STORE, LOG), os.O_WRONLY | os.O_APPEND | os.O_CREAT | BINARY)
     try:
         os.write(fd, (dumps(record, sort_keys=True) + "\n").encode("utf-8"))
     finally:
@@ -239,7 +240,7 @@ def harness_dir(root):
     path = os.path.join(root, STORE, HARNESS)
     if not os.path.isdir(path):
         os.makedirs(path, exist_ok=True)
-        with open(os.path.join(path, ".gitignore"), "w", encoding="utf-8") as fh:
+        with open(os.path.join(path, ".gitignore"), "w", encoding="utf-8", newline="\n") as fh:
             fh.write("*\n")
     return path
 
@@ -268,7 +269,7 @@ def gate(event):
     if has_report(root, name):
         return None
     try:
-        fd = os.open(os.path.join(harness_dir(root), "%s.denied" % aid), os.O_WRONLY | os.O_CREAT | os.O_EXCL)
+        fd = os.open(os.path.join(harness_dir(root), "%s.denied" % aid), os.O_WRONLY | os.O_CREAT | os.O_EXCL | BINARY)
         os.close(fd)
     except FileExistsError:
         return None   # denied once already: let this hand-back through
@@ -303,7 +304,7 @@ def read(tmp, name):
         os.makedirs(os.path.join(tmp, STORE))
         sess = os.path.join(tmp, "s")
         os.makedirs(os.path.join(sess, "subagents"))
-        json.dump({"name": "author-w03-2"}, open(os.path.join(sess, "subagents", "agent-a1.meta.json"), "w", encoding="utf-8"))
+        json.dump({"name": "author-w03-2"}, open(os.path.join(sess, "subagents", "agent-a1.meta.json"), "w", encoding="utf-8", newline="\n"))
         atp = os.path.join(sess, "subagents", "agent-a1.jsonl")
         sha = hashlib.sha256(b"x").hexdigest()[:12]
         forged = ("line one\n## hand-back 9 | 2026-01-01T00:00:00+00:00 | agent_id=a1 type=t event=e status=delivered bytes=1 sha256=%s\n"
@@ -320,7 +321,7 @@ def read(tmp, name):
         fire(tmp, hook_event_name="PostToolUse", tool_name="SubagentHandback", agent_id="a2", agent_type="x:y",
              tool_input={"message": "auto mode"}, transcript_path=sess + ".jsonl")
         assert read(tmp, "x-y-a2.md")[0]["text"] == b"auto mode"
-        open(os.path.join(sess, "subagents", "agent-a5.jsonl"), "w", encoding="utf-8").write('{"message":{"content":"Your name is explorer-w02-c. Read first: x"}}\n')
+        open(os.path.join(sess, "subagents", "agent-a5.jsonl"), "w", encoding="utf-8", newline="\n").write('{"message":{"content":"Your name is explorer-w02-c. Read first: x"}}\n')
         fire(tmp, hook_event_name="PostToolUse", tool_name="SubagentHandback", agent_id="a5", agent_type="x:y",
              tool_input={"message": "name from the brief"}, transcript_path=sess + ".jsonl")
         assert read(tmp, "wave-02-explorer-w02-c.md")[0]["text"] == b"name from the brief"
@@ -334,7 +335,7 @@ def read(tmp, name):
         assert len(os.listdir(os.path.join(tmp, STORE, FOLDER))) == 5
         # the report check: explorers only, once, by file name in the path, logged, state ignored by git
         pre = dict(hook_event_name="PreToolUse", tool_name="SubagentHandback", agent_type="murmuration:explorer", transcript_path=sess + ".jsonl")
-        open(os.path.join(sess, "subagents", "agent-e1.jsonl"), "w", encoding="utf-8").write('{"message":{"content":"Your name is explorer-w02-c. Read first: x"}}\n')
+        open(os.path.join(sess, "subagents", "agent-e1.jsonl"), "w", encoding="utf-8", newline="\n").write('{"message":{"content":"Your name is explorer-w02-c. Read first: x"}}\n')
         first = json.loads(fire(tmp, agent_id="e1", tool_input={"message": "m"}, **pre))["hookSpecificOutput"]
         assert first["permissionDecision"] == "deny" and "__reports__/wave-02/explorer-w02-c/00-findings_v0.md" in first["permissionDecisionReason"], first
         assert fire(tmp, agent_id="e1", tool_input={"message": "m"}, **pre) == "", "the second hand-back goes through"
@@ -342,12 +343,12 @@ def read(tmp, name):
         assert open(os.path.join(tmp, STORE, HARNESS, ".gitignore"), encoding="utf-8").read() == "*\n"
         for other in ("explorer-w02-cc", "explorer-w02-c0"):   # a longer name that starts with ours is not our report
             os.makedirs(os.path.join(tmp, "__reports__", "wave-02", other))
-            open(os.path.join(tmp, "__reports__", "wave-02", other, "x.md"), "w", encoding="utf-8").write("x")
-        open(os.path.join(sess, "subagents", "agent-e2.jsonl"), "w", encoding="utf-8").write('{"message":{"content":"Your name is explorer-w02-c. Read first: x"}}\n')
+            open(os.path.join(tmp, "__reports__", "wave-02", other, "x.md"), "w", encoding="utf-8", newline="\n").write("x")
+        open(os.path.join(sess, "subagents", "agent-e2.jsonl"), "w", encoding="utf-8", newline="\n").write('{"message":{"content":"Your name is explorer-w02-c. Read first: x"}}\n')
         assert fire(tmp, agent_id="e2", tool_input={"message": "m"}, **pre) != "", "another agent's report does not count"
         os.makedirs(os.path.join(tmp, "__reports__", "somewhere", "explorer-w02-c"))
-        open(os.path.join(tmp, "__reports__", "somewhere", "explorer-w02-c", "notes.md"), "w", encoding="utf-8").write("x")
-        open(os.path.join(sess, "subagents", "agent-e3.jsonl"), "w", encoding="utf-8").write('{"message":{"content":"Your name is explorer-w02-c. Read first: x"}}\n')
+        open(os.path.join(tmp, "__reports__", "somewhere", "explorer-w02-c", "notes.md"), "w", encoding="utf-8", newline="\n").write("x")
+        open(os.path.join(sess, "subagents", "agent-e3.jsonl"), "w", encoding="utf-8", newline="\n").write('{"message":{"content":"Your name is explorer-w02-c. Read first: x"}}\n')
         assert fire(tmp, agent_id="e3", tool_input={"message": "m"}, **pre) == "", "a file anywhere under __reports__ with the name in its path counts"
         assert not os.path.exists(os.path.join(tmp, STORE, HARNESS, "e3.denied")), "no deny, so no marker"
         assert fire(tmp, agent_id="e4", tool_input={"message": "m"}, **dict(pre, agent_type="murmuration:author")) == "", "explorers only"
diff --git a/plugins/murmuration/scripts/install_binary.py b/plugins/murmuration/scripts/install_binary.py
index b880078..d053df9 100644
--- a/plugins/murmuration/scripts/install_binary.py
+++ b/plugins/murmuration/scripts/install_binary.py
@@ -1,13 +1,14 @@
 #!/usr/bin/env python3
-"""SessionStart hook: put the plugin's hook program where the hook rows exec it, `${CLAUDE_PLUGIN_DATA}/bin/murmuration` (subcommands `budget`, `handback`), once per session; the Rust binary only when nothing doubts it.
+"""SessionStart hook: put the plugin's hook program where the hook rows exec it, `${CLAUDE_PLUGIN_DATA}/bin/murmuration.exe` on every OS (subcommands `budget`, `handback`), once per session; the Rust binary only when nothing doubts it.
 
 Python standard library only; hooks.json starts it in exec form (`python3 -S -I install_binary.py`, no shell).
-The binary for this platform (`bin/<target>/<binary name>`: macOS or Linux, arm64/aarch64 or x86_64; the name and the target list come from scripts/build_manifest.py; Windows installs are a later cycle) is installed only when all of these hold:
+The binary for this platform (`bin/<target>/<binary name>`: macOS or Linux, arm64/aarch64 or x86_64, or Windows x86_64; the name and the target list come from scripts/build_manifest.py) is installed only when all of these hold:
   (a) its sha256 equals the one in `bin/manifest.json`, and the manifest lists every binary that bin/ holds;
   (b) the sha256 of `scripts/budget.py`, `handback.py`, `run_hook.py` and of the Rust sources (computed with scripts/build_manifest.py's rule) equal the manifest's, which binds the binary to the scripts and to the listed Rust sources that are on disk (the hashes do not show how the binary was built: CI building the binary and the manifest from one checkout does);
   (c) a copy of it, run on six budget and hand-back events in a temporary lab (`hook_selftest`), gives the Python scripts' stdout, exit code, log kinds and hand-back file.
 On any doubt (and where no binary fits the platform) it installs a launcher that runs `scripts/run_hook.py` instead, and tells the session why: a SessionStart
-`additionalContext` line the model sees, and a line on stderr. A previous install is replaced by the launcher in that case. Copies are atomic (temporary file, then rename), so concurrent
+`additionalContext` line the model sees, and a line on stderr. A previous install is replaced by the launcher in that case. On Windows there is no launcher (it is a POSIX shell script): a previous install is removed, and the budget and hand-back hooks fail without blocking until a binary installs.
+The names are `bin/murmuration.exe` and its stamp `bin/murmuration.exe.verified`, whatever the OS: version 0.2.0 owns `bin/murmuration` and `bin/.verified` in the same data folder, and the two versions must not overwrite each other's files. Copies are atomic (temporary file, then rename), so concurrent
 sessions installing into one data folder never expose a partial file. A stamp file next to the binary records what was verified; while binary, sources and stamp agree, the self-test is not repeated.
 Errors that stop the install itself (a data folder that cannot be written, the plugin variables missing) exit 1 with a message on stderr; the budget and hand-back rows then fail without blocking anything.
 """
@@ -21,9 +22,11 @@
 import sys
 
 SCRIPTS = ["budget.py", "handback.py", "run_hook.py"]   # as in build_manifest.py
-# hosts whose installs are supported; the triples are build_manifest.ALL_TARGETS (Windows stays out until its install path exists: the SessionStart rows exec `python3` and the data path is bin/murmuration)
+# hosts whose installs are supported; the triples are build_manifest.ALL_TARGETS (platform.machine() says AMD64 on Windows)
 TARGETS = {("Darwin", "arm64"): "aarch64-apple-darwin", ("Darwin", "x86_64"): "x86_64-apple-darwin",
-           ("Linux", "x86_64"): "x86_64-unknown-linux-gnu", ("Linux", "aarch64"): "aarch64-unknown-linux-gnu"}
+           ("Linux", "x86_64"): "x86_64-unknown-linux-gnu", ("Linux", "aarch64"): "aarch64-unknown-linux-gnu",
+           ("Windows", "AMD64"): "x86_64-pc-windows-msvc"}
+WINDOWS = os.name == "nt"   # a name so that the self-test can take the Windows doubt branch on any host
 
 
 def digest(path):
@@ -115,6 +118,22 @@ def doubt(root, target):
         return "the Rust sources cannot be hashed (%s)" % type(exc).__name__
 
 
+def mask_lab(data, leaf):
+    """`data` (bytes) with the lab's random leaf name (`tmpab12cd`, os.path.basename of its path) replaced by `<LAB>`. The two labs come from one temporary folder, so their parents agree; the leaf is the one part of the path that no JSON escaping (doubled backslashes, `\\uXXXX` for a non-ASCII user name) changes."""
+    return data.replace(leaf.encode(), b"<LAB>")
+
+
+def show_step(step, limit=160):
+    """One step's (exit code, stdout, stderr), each stream cut to `limit` characters, for the reason a difference is reported with (the labs are already masked)."""
+    code, out, err = step
+    return "exit %s, stdout %s, stderr %s" % (code, repr(out)[:limit], repr(err)[:limit])
+
+
+def show_records(records, limit=240):
+    """The (harness.jsonl event kinds, hand-back files) of one program, cut to `limit` characters."""
+    return repr(records)[:limit]
+
+
 def hook_selftest(root, binary):
     """The name of the first budget or handback step on which the binary and the Python scripts (run by this interpreter) differ, or None.
 
@@ -131,7 +150,7 @@ def run(cmd, lab, event):
         env = dict(os.environ, CLAUDE_PLUGIN_ROOT=root, LC_ALL="en_US.UTF-8")
         env.pop("CLAUDE_PROJECT_DIR", None)
         p = subprocess.run(cmd, input=json.dumps(dict(event, cwd=lab, transcript_path=lab + "/s.jsonl")).encode(), capture_output=True, timeout=10, env=env)
-        return p.returncode, p.stdout.replace(lab.encode(), b"<LAB>"), p.stderr.replace(lab.encode(), b"<LAB>")   # the start note names the lab's absolute path, and each program runs in its own temporary lab
+        return p.returncode, mask_lab(p.stdout, os.path.basename(lab)), mask_lab(p.stderr, os.path.basename(lab))   # the start note names the lab's absolute path, and each program runs in its own temporary lab
 
     results = []
     for who in ("python", "binary"):
@@ -165,9 +184,9 @@ def run(cmd, lab, event):
             results.append((out, log, shake))
     for n, (a, b) in enumerate(zip(*[r[0] for r in results])):
         if a != b:
-            return "step %d" % (n + 1)
+            return "step %d: python %s; binary %s" % (n + 1, show_step(a), show_step(b))
     if results[0][1] != results[1][1] or results[0][2] != results[1][2]:
-        return "the records written"
+        return "the records written: python %s; binary %s" % (show_records(results[0][1:]), show_records(results[1][1:]))
     return None
 
 
@@ -188,7 +207,7 @@ def install(root, data, target):
     """Install and return (state, reason): state is 'binary' or 'launcher'; reason says why the launcher."""
     dest_dir = os.path.join(data, "bin")
     os.makedirs(dest_dir, exist_ok=True)
-    dest, stamp = os.path.join(dest_dir, "murmuration"), os.path.join(dest_dir, ".verified")
+    dest, stamp = os.path.join(dest_dir, "murmuration.exe"), os.path.join(dest_dir, "murmuration.exe.verified")
     reason = doubt(root, target)
     if reason is None:
         src = os.path.join(root, "bin", target, load_manifest_tool(root).binary_name(target))
@@ -206,16 +225,29 @@ def install(root, data, target):
         os.chmod(tmp, 0o755)
         bad = hook_selftest(root, tmp)
         if bad is None:
-            os.replace(tmp, dest)
-            atomic_write(stamp, want_stamp.encode(), 0o644)
+            try:
+                os.replace(tmp, dest)
+                atomic_write(stamp, want_stamp.encode(), 0o644)
+            except OSError:   # an exe held open by another session (Windows): do not leave the copy behind on every retry
+                try:
+                    os.remove(tmp)
+                except OSError:
+                    pass
+                raise
             return "binary", None
         os.remove(tmp)
         reason = "the binary's `budget/handback` differs from the Python script on the self-test (%s)" % bad
-    body = launcher_body(root)
     try:
         os.remove(stamp)
     except OSError:
         pass
+    if WINDOWS:   # the launcher is a POSIX shell script, which no Windows exec runs: leave no file, so that a stale binary does not keep running either
+        try:
+            os.remove(dest)
+        except FileNotFoundError:
+            pass
+        return "launcher", reason
+    body = launcher_body(root)
     try:
         if open(dest, "rb").read() == body:
             return "launcher", reason
@@ -239,9 +271,9 @@ def selftest():
     here = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
     target = "x86_64-unknown-linux-gnu"
     other = "aarch64-unknown-linux-gnu"
-    assert ("Windows", "AMD64") not in TARGETS and not any(k[0] == "Windows" for k in TARGETS)
+    assert TARGETS[("Windows", "AMD64")] == "x86_64-pc-windows-msvc"
     assert TARGETS[("Linux", "x86_64")] == target and TARGETS[("Linux", "aarch64")] == other
-    assert sorted(TARGETS.values()) == sorted(t for t in load_manifest_tool(here).ALL_TARGETS if "windows" not in t)
+    assert sorted(TARGETS.values()) == sorted(load_manifest_tool(here).ALL_TARGETS)
     with tempfile.TemporaryDirectory() as tmp:
         tmp = os.path.realpath(tmp)
         base = os.path.join(tmp, "base")
@@ -277,9 +309,14 @@ def fresh(name, setup=None):
         # positive control: nothing doubts it, and install() puts the binary in place
         root = fresh("control")
         assert doubt(root, target) is None, doubt(root, target)
+        old = {"murmuration": b"0.2.0 binary", ".verified": b"0.2.0 stamp"}   # version 0.2.0's files in the shared data folder: installing the binary must not touch them (the Windows doubt branch below is checked against a copy of them too)
+        for n, data in old.items():
+            write(os.path.join(tmp, "control-data", "bin", n), data, 0o644)
         state, reason = install(root, os.path.join(tmp, "control-data"), target)
         assert (state, reason) == ("binary", None), (state, reason)
-        assert open(os.path.join(tmp, "control-data", "bin", "murmuration"), "rb").read() == launcher_body(root) + b"# stands in for the binary\n"
+        assert open(os.path.join(tmp, "control-data", "bin", "murmuration.exe"), "rb").read() == launcher_body(root) + b"# stands in for the binary\n"
+        assert os.path.isfile(os.path.join(tmp, "control-data", "bin", "murmuration.exe.verified")) and sorted(os.listdir(os.path.join(tmp, "control-data", "bin"))) == [".verified", "murmuration", "murmuration.exe", "murmuration.exe.verified"]
+        assert all(open(os.path.join(tmp, "control-data", "bin", n), "rb").read() == data for n, data in old.items())
         assert doubt(root, None).startswith("no binary is built for this platform")
 
         def flip(path):
@@ -351,7 +388,7 @@ def mutate(root):
             mutate(root)
             state, reason = install(root, data, target)
             assert state == "launcher" and reason is not None and want in reason, (name, state, reason)
-            assert open(os.path.join(data, "bin", "murmuration"), "rb").read() == launcher_body(root) and not os.path.exists(os.path.join(data, "bin", ".verified")), name
+            assert open(os.path.join(data, "bin", "murmuration.exe"), "rb").read() == launcher_body(root) and not os.path.exists(os.path.join(data, "bin", "murmuration.exe.verified")), name
             if name.startswith("stale"):
                 d = doubt(root, target)
                 assert (d is None) == (name == "stale_new"), (name, d)   # the old manifest is caught by a hash; the regenerated one only by the self-tests
@@ -361,6 +398,40 @@ def mutate(root):
         for rel in ("rust/.DS_Store", "rust/src/.DS_Store", "rust/target/release/x.rs", "rust/src/notes.txt"):
             write(os.path.join(os.path.join(tmp, "control"), rel), b"stray", 0o644)
         assert doubt(os.path.join(tmp, "control"), target) is None
+        # the lab's leaf is masked whatever escaping the rest of the path went through: a Windows path (backslashes doubled, doubled again inside a quoted string), a non-ASCII user name (raw in the note, \\u00e9 in the envelope)
+        for user in ("RUNNER~1", "Jos\u00e9"):
+            outs = []
+            for leaf in ("tmpab12", "tmpcd34"):
+                wlab = "C:\\Users\\%s\\%s" % (user, leaf)
+                note = "the lab %s and %s" % (json.dumps(wlab, ensure_ascii=False), json.dumps(wlab))
+                outs.append(mask_lab(json.dumps({"c": note}).encode() + b"\n" + wlab.encode("utf-8"), leaf))
+                assert leaf.encode() not in outs[-1] and b"<LAB>" in outs[-1], (user, outs[-1])
+            assert outs[0] == outs[1], (user, outs)
+        # a replace that fails (an exe held open, taken here as a directory in the way) leaves no copy behind
+        root = fresh("held")
+        os.makedirs(os.path.join(tmp, "held-data", "bin", "murmuration.exe", "x"))
+        try:
+            install(root, os.path.join(tmp, "held-data"), target)
+            raise AssertionError("the install did not fail")
+        except OSError:
+            pass
+        assert sorted(os.listdir(os.path.join(tmp, "held-data", "bin"))) == ["murmuration.exe"], os.listdir(os.path.join(tmp, "held-data", "bin"))
+        # Windows has no launcher: the doubt branch removes the binary and its stamp (taken on this host by setting WINDOWS), and leaves 0.2.0's files alone
+        global WINDOWS
+        was, WINDOWS = WINDOWS, True
+        try:
+            root = fresh("windows")
+            data = os.path.join(tmp, "windows-data")
+            assert install(root, data, target) == ("binary", None)
+            write(os.path.join(data, "bin", "murmuration"), b"0.2.0 binary", 0o644)
+            mutate = m_sources
+            mutate(root)
+            state, reason = install(root, data, target)
+            assert state == "launcher" and "Rust sources changed" in reason, (state, reason)
+            assert sorted(os.listdir(os.path.join(data, "bin"))) == ["murmuration"], os.listdir(os.path.join(data, "bin"))
+            assert install(root, data, target) == ("launcher", reason)   # nothing to remove the second time
+        finally:
+            WINDOWS = was
     print("selftest install_binary: ok (%d mutations)" % len(cases))
     return 0
 
@@ -388,7 +459,10 @@ def main():
         sys.stderr.write("murmuration install: cannot install the hook binary into %s (%s: %s); the budget and hand-back hooks will fail until this is fixed\n" % (data, type(exc).__name__, exc))
         return 1
     if state == "launcher":
-        note = "murmuration: the plugin's budget and hand-back hooks run as the Python scripts, not the Rust binary, because %s. Decisions are the Python scripts'. The binary comes from CI (the `build(bin)` commit of the plugin's repository); until a release carries one that matches these files, the Python scripts decide, which is correct and slower." % reason
+        if WINDOWS:
+            note = "murmuration: the plugin's budget and hand-back hooks are off on Windows, because %s. There is no launcher there; the hooks fail without blocking until a binary installs. The binary comes from CI (the `build(bin)` commit of the plugin's repository)." % reason
+        else:
+            note = "murmuration: the plugin's budget and hand-back hooks run as the Python scripts, not the Rust binary, because %s. Decisions are the Python scripts'. The binary comes from CI (the `build(bin)` commit of the plugin's repository); until a release carries one that matches these files, the Python scripts decide, which is correct and slower." % reason
         sys.stderr.write(note + "\n")
         sys.stdout.write(json.dumps({"hookSpecificOutput": {"hookEventName": "SessionStart", "additionalContext": note}}))
     return 0