diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 20894f750..e4d7fec95 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -88,6 +88,7 @@ tests\scripts\run_test_configs.ps1            # All test configs via wxc_test_dr
 tests\scripts\run_basicprocess_test.ps1            # Single process container test
 tests\scripts\run_isolation_session_tests.ps1                # IsolationSession one-shot E2E (requires host with the OS-side IsoSessionOps service)
 tests\scripts\run_isolation_session_state_aware_tests.ps1    # IsolationSession state-aware lifecycle E2E (multi-invocation provision/start/exec/stop/deprovision, same host requirements)
+tests\scripts\run_windows_sandbox_one_shot_tests.ps1       # Windows Sandbox one-shot E2E (fresh disposable VM per test; requires the Windows Sandbox optional feature)
 tests\scripts\run_lxc_all_tests.sh            # All LXC tests (Linux)
 tests\scripts\run_bwrap_all_tests.sh          # All Bubblewrap tests (Linux, requires bwrap)
 
@@ -108,7 +109,7 @@ The Rust workspace (`src/`) implements multiple sandboxing backends behind the `
 |---------|--------|----------|--------|
 | AppContainer | `wxc-exec.exe` | Windows | `backends/appcontainer/common/src/appcontainer_runner.rs` |
 | BaseContainer (OS sandbox API) | `wxc-exec.exe` | Windows | `backends/appcontainer/common/src/base_container_runner.rs` — calls `Experimental_CreateProcessInSandbox` via FlatBuffer |
-| Windows Sandbox | `wxc-exec.exe` | Windows | `backends/windows_sandbox/common/src/windows_sandbox_runner.rs` |
+| Windows Sandbox | `wxc-exec.exe` | Windows | `backends/windows_sandbox/lifecycle/src/` — transient one-shot `WindowsSandboxRunner` (`ScriptRunner`). Experimental — requires `--experimental`. Each invocation launches a **fresh, disposable** Windows Sandbox VM, runs the script once, and guarantees teardown on every exit path (no warm-VM reuse; the legacy `experimental.windows_sandbox.idleTimeoutMs`/`daemonPipeName` fields are accepted but ignored, with a warning only for non-default values). The boot sequence (write per-launch nonce, launch VM, capture ownership proof, wait rendezvous, connect) lives in `lifecycle/src/vm.rs`; per-launch handshake is a 32-byte `Nonce` + 1-byte `ChannelRole` tag on every TCP connection (`windows_sandbox_common::auth`), so the guest pairs sockets by declared role, not accept order. Feature detection is by `WindowsSandbox.exe` presence (no elevated DISM query). The guest agent `wxc-windows-sandbox-guest.exe` (`backends/windows_sandbox/guest/`) is injected into the VM. (State-aware lifecycle + host daemon land in a follow-up.) |
 | MicroVM (NanVix) | `wxc-exec.exe` | Windows | `backends/nanvix/runner/src/lib.rs` — feature-gated behind `microvm` |
 | Hyperlight | `wxc-exec.exe` | Windows | `backends/hyperlight/common/src/lib.rs` — Hyperlight + Unikraft micro-VM backend |
 | IsolationSession | `wxc-exec.exe` | Windows | `backends/isolation_session/common/src/` — feature-gated behind `isolation_session`, experimental, uses the in-proc `Windows.AI.IsolationSession` `IsoSessionOps` API (loaded from `IsoSessionApp.dll`). Supports both one-shot (single-invocation lifecycle, via `ScriptRunner`) and state-aware (multi-invocation provision/start/exec/stop/deprovision, via `StatefulSandboxBackend`) modes. Honors `readwritePaths` and `readonlyPaths` at provision via `ShareFolderBatchAsync` (rejects `deniedPaths` since the API has no Deny ACE primitive); filesystem policy is immutable post-provision and rejected at later phases. State-aware additionally accepts an optional `user` bundle (`upn`, `wamToken`) at provision and start to provision Entra cloud-agent sandboxes; one-shot rejects the bundle, and hosts that don't support Entra agents surface `backend_unavailable`. Streams stdout/stderr, forwards stdin, and switches to ConPTY mode when wxc-exec's stdout is a TTY for `spawnSandbox` parity. |
@@ -189,16 +190,16 @@ The workspace is organized into six top-level directories under `src/`:
 | Directory | Purpose | Examples |
 |-----------|---------|----------|
 | `core/` | Cross-platform foundation + per-platform aggregator binaries | `wxc_common/`, `wxc/`, `lxc/`, `mxc_darwin/`, `mxc_engine/`, `mxc-sdk/`, `mxc_pty/`, `mxc_build_common/`, `generated/` |
-| `backends/` | Backend-specific code (one subfolder per containment backend) | `appcontainer/common`, `windows_sandbox/{daemon,guest,common}`, `isolation_session/{bindings,common}`, `hyperlight/common`, `nanvix/{common,build_common,binaries,runner}`, `lxc/common`, `bubblewrap/common`, `wslc/common`, `seatbelt/common` |
+| `backends/` | Backend-specific code (one subfolder per containment backend) | `appcontainer/common`, `windows_sandbox/{daemon,guest,common,lifecycle}`, `isolation_session/{bindings,common}`, `hyperlight/common`, `nanvix/{common,build_common,binaries,runner}`, `lxc/common`, `bubblewrap/common`, `wslc/common`, `seatbelt/common` |
 | `ffi/` | Foreign-function-interface crates (C ABI for language bindings) | `mxc_ffi/` |
 | `host/` | Host-side utilities | `wxc_host_prep/`, `wxc_winhttp_proxy_shim/` |
 | `testing/` | Test infrastructure crates | `wxc_e2e_tests/`, `wxc_test_driver/`, `wxc_test_proxy/`, `linux_test_proxy/`, `wxc_ui_probe/`, `fuzz/` |
 | `tools/` | Developer/diagnostic tools | `mxc_diagnostic_console/` |
 
 - `wxc_common` is the **cross-platform foundation**: config parsing, models, errors, logger, `ScriptRunner` / `StatefulSandboxBackend` traits, state-aware dispatch helpers, validators, ids, ui-policy, encoding. Plus a few thin Windows API helpers shared by host tools and backends (`process_util`, `string_util`, `filesystem_dacl`, `diagnostic`). It must not depend on any `backends/*` crate.
-- Each Windows containment backend lives in its own `backends/*/common` crate (e.g. `appcontainer_common`, `windows_sandbox_common`, `isolation_session_common`, `hyperlight_common`, `nanvix_runner`). Backend crates depend on `wxc_common`; there are no cross-edges between backend crates.
+- Each Windows containment backend lives in its own `backends/*/common` crate (e.g. `appcontainer_common`, `windows_sandbox_common`, `isolation_session_common`, `hyperlight_common`, `nanvix_runner`). Backend crates depend on `wxc_common`; there are no cross-edges between backend crates. Windows Sandbox additionally has `windows_sandbox_lifecycle`, which owns the live one-shot runner and depends on `windows_sandbox_common` for the wire protocol.
 - `wxc`, `lxc`, and `mxc_darwin` are thin binary crates (`wxc-exec` / `lxc-exec` / `mxc-exec-mac`) that wire up CLI args (`clap`), load/validate config, handle maintenance modes (`--probe`, `--delete`, `--setup-*`, `--audit`), and **delegate all backend dispatch to `mxc_engine`**. They contain no `match request.containment` of their own. `wxc-exec` additionally owns the Windows Ctrl-C / DACL-cleanup / `--audit` PLM-trace / telemetry orchestration around the engine call.
-- `mxc_engine` is the **single execution engine** — the one home for "given an `ExecutionRequest`, run it". It owns: run-to-completion backend selection (`run` / `resolve_runner`, covering **all** backends, incl. the Windows ProcessContainer BaseContainer/AppContainer BFS/DACL fallback tiers via `appcontainer_common::dispatcher::dispatch_with_fallback`, and every experimental backend, feature-gated); streaming (`spawn` → `Box<dyn SandboxProcess>`); state-aware lifecycle dispatch (`run_state_aware`); host probing (`platform_support` / `PlatformSupport`); and config building (`build_request`, `SandboxPolicy` + sections, `available_tools_policy`/`user_profile_policy`/`temporary_files_policy`). It depends on the backend crates (cfg-split: appcontainer/windows_sandbox/isolation_session/wslc/nanvix on Windows, bubblewrap/lxc/nanvix on Linux, seatbelt on macOS) so it can't live in `wxc_common`. Both the executor binaries and `mxc-sdk` call into it. `ResolvedRunner` carries the boxed runner plus (Windows only) the optional `DaclManager` guard, so `wxc-exec` can park the guard for its signal handler.
+- `mxc_engine` is the **single execution engine** — the one home for "given an `ExecutionRequest`, run it". It owns: run-to-completion backend selection (`run` / `resolve_runner`, covering **all** backends, incl. the Windows ProcessContainer BaseContainer/AppContainer BFS/DACL fallback tiers via `appcontainer_common::dispatcher::dispatch_with_fallback`, and every experimental backend, feature-gated); streaming (`spawn` → `Box<dyn SandboxProcess>`); state-aware lifecycle dispatch (`run_state_aware`); host probing (`platform_support` / `PlatformSupport`); and config building (`build_request`, `SandboxPolicy` + sections, `available_tools_policy`/`user_profile_policy`/`temporary_files_policy`). It depends on the backend crates (cfg-split: appcontainer/windows_sandbox lifecycle/isolation_session/wslc/nanvix on Windows, bubblewrap/lxc/nanvix on Linux, seatbelt on macOS) so it can't live in `wxc_common`. Both the executor binaries and `mxc-sdk` call into it. `ResolvedRunner` carries the boxed runner plus (Windows only) the optional `DaclManager` guard, so `wxc-exec` can park the guard for its signal handler.
 - `mxc-sdk` is the **public Rust SDK** — a thin facade over `mxc_engine`. Build a `SandboxRequest` with `build_request`, then either `run(request)` (run-to-completion; returns an `Output` with the `WaitOutcome` + captured `stdout`/`stderr`) or `spawn_sandbox(request)` (returns a `Sandbox` handle for live bidirectional stdio — `take_stdin`/`take_stdout`/`take_stderr`, `kill()`, `wait()` returning a `WaitOutcome` (`Exited(i32)` / `TimedOut`) as `io::Result`, or `wait_with_output()`). It re-exports the engine's config-building surface (`build_request`, `mxc_sdk::policy::{SandboxPolicy sections}`, discovery helpers) and `platform_support`; `mod sandbox` (wrapping the engine's `SandboxProcess` in `Sandbox`) is its only local module. No pty is ever allocated. Streaming supports Seatbelt (macOS), Bubblewrap (Linux), and Windows ProcessContainer (AppContainer + BaseContainer); other backends return `ErrorCode::UnsupportedContainment`.
 - The lower-level execution surface lives in `wxc_common::sandbox_process`: the `SandboxBackend` trait (`validate` + `spawn(request, logger, StdioMode) -> Box<dyn SandboxProcess>` + a `diagnose_exit` hook) and the generic `Runner<B>` adapter that bridges any `SandboxBackend` to the run-to-completion `ScriptRunner` (via `spawn(StdioMode::Inherit)` then `wait()`). `StdioMode::Pipes` hands the caller live stdin/stdout/stderr (what the `mxc-sdk` streaming path uses); `StdioMode::Inherit` lets the child inherit the host's stdio (what the executor binaries use, preserving the TTY under a pty). `SandboxBackend` is implemented for Seatbelt, Bubblewrap, and Windows ProcessContainer.
 - `mxc_ffi` (`ffi/mxc_ffi`, `crate-type = ["cdylib", "staticlib", "lib"]`) is a flat, panic-safe **C ABI over `mxc-sdk`** for language bindings. `mxc_run(policyJson, command, out)` runs a sandbox to completion, filling a `#[repr(C)] MxcRunResult` (status + exit_code + timed_out + owned stdout/stderr/error C strings); every entry point is `catch_unwind`-wrapped so a panic becomes a status code, never an unwind. Its `build.rs` runs **csbindgen** to generate the C# P/Invoke (`sdk/dotnet/Microsoft.Mxc.Sdk/Native/NativeMethods.g.cs`), gated behind the crate's **`dotnetsdk`** feature (off by default, so the whole-workspace backend build matrix doesn't compile csbindgen). The generated file is **not committed** (gitignored); the C# csproj regenerates it at build time and `scripts/check-dotnet-bindings-codegen.js` runs the codegen in CI and asserts the expected entry points are produced. The C ABI is **not a stable external contract** (native + binding are co-versioned and generated together; see the crate docs). Currently exposes run-to-completion only; streaming + state-aware over FFI are deferred.
diff --git a/docs/windows-sandbox/windows-sandbox-reference.md b/docs/windows-sandbox/windows-sandbox-reference.md
index d1f9672fa..27aabf0cc 100644
--- a/docs/windows-sandbox/windows-sandbox-reference.md
+++ b/docs/windows-sandbox/windows-sandbox-reference.md
@@ -1,211 +1,248 @@
-# Windows Sandbox Backend — Reference
+# Windows Sandbox One-Shot Backend - Reference
 
-Detailed reference for the sandbox backend internals. For the high-level design overview, see [windows-sandbox.md](windows-sandbox.md).
+This document describes the one-shot implementation. For the high-level
+overview, see [windows-sandbox.md](windows-sandbox.md).
 
-## IPC Protocol
+## Host-to-Guest Protocol
 
-### wxc-exec ↔ Daemon (line-based TCP)
+The host opens four TCP connections to the guest:
 
-The daemon listens on a localhost TCP port derived deterministically from the pipe name:
+| Channel | Purpose |
+|---|---|
+| Control | Protocol preamble and JSON control messages |
+| Stdin | Child standard input |
+| Stdout | Child standard output |
+| Stderr | Child standard error |
 
-```rust
-fn pipe_name_to_port(name: &str) -> u16 {
-    let hash: u32 = name.bytes()
-        .fold(0u32, |acc, b| acc.wrapping_mul(31).wrapping_add(b as u32));
-    let range = 65535 - 49152;
-    49152 + (hash % range) as u16
-}
+### Authentication and channel roles
+
+Before any protocol data, each connection sends:
+
+```text
+[32-byte per-launch nonce][1-byte ChannelRole]
 ```
 
-**Protocol:**
-- Client → Daemon: `EXEC <json>\n`
-- Daemon → Client: `RESULT <exit-code> <stdout-base64> <stderr-base64> <error-message>\n`
-- Daemon → Client: `ERROR <message>\n`
+The nonce is generated for each VM launch, written into the secured rendezvous
+directory, consumed and deleted by the guest, and compared without
+data-dependent early exit. The role byte identifies control, stdin, stdout, or
+stderr, so sockets are paired by declaration rather than TCP accept order.
 
-### Daemon ↔ Agent (length-prefixed JSON over TCP)
+Unauthenticated, duplicate-role, stalled, or unexpected-role connections are
+dropped. Same-user processes remain within the backend's trust boundary.
 
-4 TCP connections: control channel + stdin + stdout + stderr.
+### Control preamble
 
-Control channel frame format: `[4 bytes: u32 LE length][JSON payload]`
+The guest begins the control channel with:
 
-| Message | Direction | Purpose |
-|---------|-----------|---------|
-| `Ready` | Agent → Host | Agent ready for EXEC commands |
-| `Exec(ExecRequest)` | Host → Agent | Execute a script |
-| `Exit(ExitNotification)` | Agent → Host | Script finished |
-| `StreamsReady` | Agent → Host | New data streams ready for next execution |
-| `Ping` / `Pong` | Either | Keepalive |
-
-## Sandbox VM Setup
-
-### Folder Mapping
-
-| Host path | Sandbox path | Access | Contents |
-|-----------|-------------|--------|----------|
-| Daemon's exe directory | `C:\sandbox-guest` | Read-only | `wxc-windows-sandbox-guest.exe` |
-| `%TEMP%\wxc-sandbox-rendezvous` | `C:\sandbox-rendezvous` | Read-write | `rendezvous.txt`, `bootstrap.cmd`, `bootstrap.log` |
-| Host Python directory | `C:\sandbox-python` | Read-only | Host's Python installation |
-
-### Bootstrap Sequence
-
-The `.wsb` LogonCommand runs `C:\sandbox-rendezvous\bootstrap.cmd`:
-
-1. Adds `C:\sandbox-python` and `C:\sandbox-python\Scripts` to PATH
-2. Sets `PYTHONDONTWRITEBYTECODE=1` and `PYTHONNOUSERSITE=1`
-3. Logs diagnostics to `bootstrap.log`
-4. Launches `wxc-windows-sandbox-guest.exe`
-
-### .wsb Configuration
-
-```xml
-<Configuration>
-  <MappedFolders>
-    <MappedFolder>
-      <HostFolder>{agent_dir}</HostFolder>
-      <SandboxFolder>C:\sandbox-guest</SandboxFolder>
-      <ReadOnly>true</ReadOnly>
-    </MappedFolder>
-    <MappedFolder>
-      <HostFolder>{rendezvous_dir}</HostFolder>
-      <SandboxFolder>C:\sandbox-rendezvous</SandboxFolder>
-      <ReadOnly>false</ReadOnly>
-    </MappedFolder>
-    <MappedFolder>
-      <HostFolder>{python_dir}</HostFolder>
-      <SandboxFolder>C:\sandbox-python</SandboxFolder>
-      <ReadOnly>true</ReadOnly>
-    </MappedFolder>
-  </MappedFolders>
-  <LogonCommand>
-    <Command>C:\sandbox-rendezvous\bootstrap.cmd</Command>
-  </LogonCommand>
-  <vGPU>Disable</vGPU>
-  <Networking>Enable</Networking>
-</Configuration>
+```text
+["WSBP"][protocol version: u32 little-endian]
 ```
 
-`vGPU` is disabled to avoid intermittent GPU virtualization failures under nested Hyper-V.
+The version is incremented only for incompatible framing, preamble, or required
+message changes. A magic or version mismatch rejects the connection before
+framed messages are processed.
 
-## Agent Startup & Rendezvous
+### Control messages
 
-1. Agent binds TCP on `0.0.0.0:0` (OS-assigned port)
-2. Discovers its IP via UDP "fake connect" to `1.1.1.1:80`
-3. Writes `<ip>:<port>` to `C:\sandbox-rendezvous\rendezvous.txt`
-4. Accepts 4 TCP connections from the daemon
-5. Locks down Windows Firewall via `netsh` — only allows host IP
-6. Sends `Ready` on control channel
-7. Enters command loop
+Control messages use a four-byte little-endian length followed by JSON.
 
-## Python in the Sandbox
+| Message | Direction | Purpose |
+|---|---|---|
+| `Ready` | Guest to host | Guest is ready for execution |
+| `Exec(ExecRequest)` | Host to guest | Execute one command |
+| `Exit(ExitNotification)` | Guest to host | Report completion |
+| `StreamsReady` | Guest to host | Protocol support for reconnectable data streams; unused for one-shot reuse |
+| `Ping` / `Pong` | Either | Liveness |
+
+The one-shot host pumps stdin, stdout, stderr, and control concurrently to avoid
+opposing TCP-window deadlocks. A reset before any output is treated as an empty
+stream; a reset after output is a transport failure so partial output is not
+silently truncated.
+
+## Per-Run Host State
+
+Each invocation creates:
+
+```text
+%TEMP%\wxc-wsb\oneshot\<run-id>\
+  oneshot.marker
+  config\
+    wxc-windows-sandbox.wsb
+  rendezvous\
+    bootstrap.cmd
+    bootstrap.log
+    nonce.bin
+    rendezvous.txt
+```
 
-Python is **not installed** inside the sandbox — the host's Python directory is mapped read-only.
+The root and run directory receive owner-only ACLs. A directory owned by
+another user is rejected because its owner retains implicit `WRITE_DAC` even
+after an ACL replacement.
 
-### Discovery (`find_host_python()`)
+The marker records:
 
-1. `where python` — skips Windows Store stubs (`WindowsApps`), verifies `python --version`
-2. Hardcoded paths: `C:\Python312`, `C:\Python311`, `C:\Python310`, `C:\Program Files\Python31x`
-3. User-scoped: `%LOCALAPPDATA%\Programs\Python\*`
+- the `wxc-exec` PID and process creation time;
+- VM host-process PID and creation-time proof captured after launch.
 
-### Read-Only Mount Workaround
+PID plus creation time prevents a recycled PID from authorising cleanup of an
+unrelated process.
 
-Python's `site` module writes `.pyc` cache to its install dir. Read-only mount causes exit code 1. Mitigated by:
-- `bootstrap.cmd` sets `PYTHONDONTWRITEBYTECODE=1` and `PYTHONNOUSERSITE=1`
-- Test configs use `python -S -B -c "..."`
+## VM Configuration
 
-### Other Languages
+The generated `.wsb` file always maps:
 
-The sandbox runs any command through `cmd.exe /C <script>`:
-- **PowerShell**: Built into Windows Sandbox — works directly
-- **cmd/batch**: Works out of the box
-- **Node.js/TypeScript**: Would need host-mapping (not implemented)
+| Host path | Guest path | Access |
+|---|---|---|
+| Directory containing `wxc-windows-sandbox-guest.exe` | `C:\Sandbox-Guest` | Read-only |
+| Per-run rendezvous directory | `C:\Sandbox-Rendezvous` | Read-write |
 
-## Daemon Lifecycle
+Filesystem policy can add existing directories at the same absolute path
+inside the guest. Read-only and read-write access follow the corresponding
+policy lists.
 
-### Startup
+The generated configuration disables vGPU, enables networking for the
+host-to-guest bridge, and runs:
 
-```
-wxc-windows-sandbox-daemon.exe <pipe-name> <idle-timeout-ms>
+```text
+C:\Sandbox-Rendezvous\bootstrap.cmd
 ```
 
-Auto-launched by `wxc-exec` if not already running.
+The bootstrap script truncates `bootstrap.log` and starts the guest agent. No
+host runtime, including Python, is implicitly discovered or mapped.
 
-### Retry & Error Handling
+## Launch Sequence
 
-| Attempt | Backoff | Action |
-|---------|---------|--------|
-| 1 | 0s | Launch sandbox, wait up to 120s for rendezvous |
-| 2 | 10s | Teardown, cleanup, relaunch |
-| 3 | 20s | Final attempt, propagate error |
+1. Validate policy and acquire the per-session host VM mutex.
+2. Secure `%TEMP%\wxc-wsb\oneshot`.
+3. Reconcile any prior marker and running `WindowsSandbox*` processes.
+4. Create the per-run directories and initial launcher marker.
+5. Generate the nonce, bootstrap script, and `.wsb` file.
+6. Launch `WindowsSandbox.exe`.
+7. Capture PID-plus-creation-time ownership proof and persist it.
+8. Wait for `rendezvous.txt`.
+9. Connect and authenticate the four guest channels.
+10. Validate the control preamble and wait for `Ready`.
+11. Send one execution request and relay stdio.
 
-### Teardown
+A failed process-enumeration probe is treated conservatively: the runner refuses
+to launch over an unknown potentially-live singleton VM.
 
-1. Kills `WindowsSandbox.exe`, `WindowsSandboxServer`, `WindowsSandboxRemoteSession`
-2. Polls for process exit (up to 30s)
-3. 5s Hyper-V cooldown
+## Policy Validation
 
-## Debugging
+### Filesystem
 
-```powershell
-# Check rendezvous file
-Get-Content "$env:TEMP\wxc-sandbox-rendezvous\rendezvous.txt"
+`readwritePaths` and `readonlyPaths` must contain absolute existing directories.
+The backend rejects:
+
+- files rather than directories;
+- one path listed with conflicting access;
+- nested or overlapping mapped roots;
+- a `deniedPaths` entry equal to, inside, or containing a mapped share.
+
+Windows Sandbox has no per-path deny primitive. A denied path outside all
+mapped shares is therefore already inaccessible and requires no additional
+rule.
+
+### Network
+
+The guest firewall supports only the default `block` policy. The backend
+rejects:
+
+- default network policy `allow`;
+- `allowedHosts` or `blockedHosts`;
+- network proxy configuration.
+
+Before binding, the guest temporarily pre-authorises its executable to avoid an
+interactive firewall prompt. After the host connects, it replaces that rule
+with host-IP/listener-port rules and sets both default directions to block.
+
+## Teardown and Crash Recovery
 
-# Check bootstrap log
-Get-Content "$env:TEMP\wxc-sandbox-rendezvous\bootstrap.log"
+The host permits one Windows Sandbox VM per logon session. A named mutex
+serialises one-shot execution with other MXC Windows Sandbox owners.
 
-# Check generated .wsb config
-Get-Content "$env:TEMP\wxc-sandbox-config\wxc-windows-sandbox.wsb"
+Normal return and panic use an ownership-scoped teardown guard. Console
+shutdown paths take the same parked ownership state and issue termination
+without waiting.
 
-# Check for zombie VM processes
-Get-Process | Where-Object { $_.ProcessName -match "vmmem|vmwp|sandbox" }
+Cleanup follows these rules:
 
-# Run daemon manually (visible logs)
-src\target\release\wxc-windows-sandbox-daemon.exe wxc-windows-sandbox 300000
-# In another terminal:
-src\target\release\wxc-exec.exe --debug tests\configs\basic_windows_sandbox.json
+- a live launcher means another one-shot invocation owns the VM, so launch is
+  refused;
+- prior ownership proof intersecting the live VM set authorises orphan reclaim;
+- a live VM without intersecting proof is treated as foreign and is never
+  enumerated into ownership;
+- markers are removed only after teardown confirms all `WindowsSandbox*`
+  processes have exited;
+- a probe failure or timeout preserves the marker for a later reclaim attempt.
 
-# Clean slate
-Get-Process -Name "wxc-windows-sandbox-daemon","WindowsSandbox*" -ErrorAction SilentlyContinue |
-  ForEach-Object { Stop-Process -Id $_.Id -Force }
-Start-Sleep 30
-Remove-Item "$env:TEMP\wxc-sandbox-rendezvous\*" -ErrorAction SilentlyContinue
+Markerless scratch directories can remain temporarily while Hyper-V processes
+hold mapped-folder handles. A later invocation garbage-collects old markerless
+directories.
+
+## Legacy Configuration
+
+The following fields remain parseable for schema compatibility but do not
+affect the one-shot backend:
+
+- `experimental.windows_sandbox.idleTimeoutMs`
+- `experimental.windows_sandbox.daemonPipeName`
+
+A targeted warning is emitted only when either value differs from its default.
+The one-shot path does not connect to `wxc-windows-sandbox-daemon.exe`.
+
+## Debugging
+
+Per-run files are normally removed after confirmed teardown. While a run is
+active, inspect the newest directory under:
+
+```powershell
+$root = Join-Path $env:TEMP "wxc-wsb\oneshot"
+$run = Get-ChildItem $root -Directory |
+    Sort-Object LastWriteTime -Descending |
+    Select-Object -First 1
+
+Get-Content (Join-Path $run.FullName "rendezvous\bootstrap.log")
+Get-Content (Join-Path $run.FullName "rendezvous\rendezvous.txt")
+Get-Content (Join-Path $run.FullName "config\wxc-windows-sandbox.wsb")
 ```
 
+Check host processes with:
+
+```powershell
+Get-Process | Where-Object { $_.ProcessName -like "WindowsSandbox*" }
+```
+
+Do not terminate processes by name during normal cleanup; the backend uses
+PID-plus-creation-time ownership proof to avoid killing an unrelated VM.
+
 ## Key Source Files
 
 | File | Purpose |
-|------|---------|
-| `src/backends/windows_sandbox/common/src/windows_sandbox_runner.rs` | Client: connects to daemon, sends EXEC, reads RESULT |
-| `src/backends/windows_sandbox/common/src/sandbox_protocol.rs` | Shared control protocol |
-| `src/backends/windows_sandbox/daemon/src/main.rs` | Daemon entry point, idle watchdog |
-| `src/backends/windows_sandbox/daemon/src/pipe_server.rs` | TCP IPC server, EXEC handling, retry logic |
-| `src/backends/windows_sandbox/daemon/src/sandbox_vm.rs` | .wsb generation, Python discovery, VM launch/teardown |
-| `src/backends/windows_sandbox/daemon/src/rendezvous.rs` | Polls rendezvous.txt |
-| `src/backends/windows_sandbox/daemon/src/tcp_bridge.rs` | 4-channel TCP bridge, execute_on_guest, reconnect |
-| `src/backends/windows_sandbox/guest/src/main.rs` | Guest entry point |
-| `src/backends/windows_sandbox/guest/src/listener.rs` | TCP listener, rendezvous writer |
-| `src/backends/windows_sandbox/guest/src/executor.rs` | Command loop, stdio bridging |
-| `src/backends/windows_sandbox/guest/src/firewall.rs` | Guest firewall lockdown |
+|---|---|
+| `src/core/mxc_engine/src/run.rs` | Selects the one-shot runner |
+| `src/backends/windows_sandbox/lifecycle/src/one_shot.rs` | One-shot orchestration |
+| `src/backends/windows_sandbox/lifecycle/src/policy.rs` | Filesystem and network validation |
+| `src/backends/windows_sandbox/lifecycle/src/vm.rs` | `.wsb` generation, launch, and ownership capture |
+| `src/backends/windows_sandbox/lifecycle/src/rendezvous.rs` | Guest address discovery |
+| `src/backends/windows_sandbox/lifecycle/src/bridge.rs` | Host-to-guest channels and stdio relay |
+| `src/backends/windows_sandbox/lifecycle/src/teardown.rs` | Markers, reconcile, and guaranteed cleanup |
+| `src/backends/windows_sandbox/lifecycle/src/control_plane.rs` | Ownership decisions and process identity |
+| `src/backends/windows_sandbox/common/src/auth.rs` | Nonce and role handshake |
+| `src/backends/windows_sandbox/common/src/sandbox_protocol.rs` | Control-channel framing |
+| `src/backends/windows_sandbox/guest/src/main.rs` | Guest startup |
+| `src/backends/windows_sandbox/guest/src/listener.rs` | Authenticated socket acceptance |
+| `src/backends/windows_sandbox/guest/src/executor.rs` | Process execution and stdio bridge |
+| `src/backends/windows_sandbox/guest/src/firewall.rs` | Guest firewall policy |
+| `src/backends/windows_sandbox/guest/src/job.rs` | Process-tree cleanup |
 
 ## E2E Tests
 
-Manual-only — requires Hyper-V + Windows Sandbox feature (cannot run in GitHub CI).
-
-### Running
+The one-shot test suite requires Windows Sandbox and Hyper-V:
 
 ```powershell
-cd tests\scripts
-.\run_windows_sandbox_tests.ps1 -Release
+.\tests\scripts\run_windows_sandbox_one_shot_tests.ps1
 ```
 
-### Test Configs
-
-| Config | Script | Validates |
-|--------|--------|-----------|
-| `windows_sandbox_echo.json` | `echo Hello from sandbox!` | Boot, stdout relay |
-| `basic_windows_sandbox.json` | `python -S -B -c "..."` | Python mapping |
-| `windows_sandbox_powershell.json` | `powershell ... "PowerShell works"` | PowerShell |
-| `windows_sandbox_powershell_env.json` | `powershell ... $env:COMPUTERNAME` | VM isolation |
-| `windows_sandbox_stderr.json` | `echo stdout && echo stderr 1>&2` | stderr relay |
-| `windows_sandbox_exit_code.json` | `exit /b 42` | Exit codes |
-| `windows_sandbox_timeout.json` | `ping -n 30 127.0.0.1` (5s timeout) | Timeout |
-| *(multi-exec)* | `windows_sandbox_echo.json` × 3 | VM reuse |
+It covers command execution, PowerShell, stderr, exit-code propagation,
+timeouts, and repeated independent fresh-VM invocations.
diff --git a/docs/windows-sandbox/windows-sandbox.md b/docs/windows-sandbox/windows-sandbox.md
index 72f86ca29..d08aaf1af 100644
--- a/docs/windows-sandbox/windows-sandbox.md
+++ b/docs/windows-sandbox/windows-sandbox.md
@@ -2,69 +2,69 @@
 
 ## Overview
 
-The Windows Sandbox backend provides VM-level isolation for script execution using [Windows Sandbox](https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview). Unlike the process container backend (which runs scripts in a sandboxed process on the host), the Sandbox backend boots an ephemeral Windows VM, executes scripts inside it, and tears it down when idle.
+The Windows Sandbox backend provides VM-level isolation using
+[Windows Sandbox](https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview).
+The one-shot surface launches a fresh disposable VM for each invocation, runs
+one command, and tears the VM down before returning. It does not use the
+host-side daemon or reuse a warm VM.
 
-This provides stronger isolation than process containers — the script runs in a completely separate OS instance with its own filesystem, registry, and network stack.
+Windows Sandbox is experimental and requires `--experimental`.
 
 ## Architecture
 
+```text
+wxc-exec.exe
+  |
+  `-- mxc_engine
+        |
+        `-- WindowsSandboxRunner (windows_sandbox_lifecycle)
+              |-- validates policy and acquires the host VM slot
+              |-- writes a per-launch nonce and generates the .wsb file
+              |-- launches WindowsSandbox.exe and records ownership proof
+              |-- waits for guest rendezvous
+              |-- opens authenticated control/stdin/stdout/stderr channels
+              |-- executes one command
+              `-- tears down the owned VM
+                    |
+                    `-- wxc-windows-sandbox-guest.exe
+                          |-- consumes the launch nonce
+                          |-- publishes its TCP address
+                          |-- authenticates and pairs channels by role
+                          |-- locks down the guest firewall
+                          `-- runs the command through cmd.exe /C
 ```
-wxc-exec.exe (CLI client)
-  │
-  └── WindowsSandboxScriptRunner (src/backends/windows_sandbox/common/src/windows_sandbox_runner.rs)
-        │
-        ├── Pre-flight: checks Windows Sandbox feature is enabled
-        ├── Connects to wxc-windows-sandbox-daemon via TCP IPC on localhost
-        │
-        └── Sends: "EXEC {json}\n"
-              │
-              wxc-windows-sandbox-daemon.exe (host-side, long-lived)
-                │
-                ├── Discovers Python on the host
-                ├── Generates .wsb config with mapped folders
-                ├── Launches WindowsSandbox.exe
-                ├── Polls rendezvous file for guest agent address
-                ├── Connects 4 TCP channels to guest agent
-                │
-                └── Bridges EXEC requests to the guest
-                      │
-                      wxc-windows-sandbox-guest.exe (inside sandbox VM)
-                        │
-                        ├── Binds TCP, writes IP:port to rendezvous file
-                        ├── Accepts 4 connections (control, stdin, stdout, stderr)
-                        ├── Locks down firewall (only allow host IP)
-                        ├── Executes scripts via cmd.exe /C
-                        └── Bridges stdin/stdout/stderr over TCP
-```
+
+The `src/backends/windows_sandbox/daemon/` crate remains in the repository for
+future state-aware lifecycle work, but the one-shot path does not start or
+connect to it.
 
 ### Components
 
-| Binary | Crate | Runs where | Purpose |
-|--------|-------|------------|---------|
-| `wxc-exec.exe` | `wxc` | Host | CLI entry point, dispatches to WindowsSandboxScriptRunner |
-| `wxc-windows-sandbox-daemon.exe` | `wxc_windows_sandbox_daemon` | Host | Manages sandbox VM lifecycle, bridges IPC to TCP |
-| `wxc-windows-sandbox-guest.exe` | `wxc_windows_sandbox_guest` | Inside sandbox VM | Accepts commands, runs scripts, bridges stdio |
+| Component | Location | Purpose |
+|---|---|---|
+| Execution engine | `src/core/mxc_engine/src/run.rs` | Selects the one-shot runner and reports ignored legacy settings |
+| Lifecycle crate | `src/backends/windows_sandbox/lifecycle/` | Policy validation, VM launch, authenticated bridge, ownership, and teardown |
+| Shared protocol | `src/backends/windows_sandbox/common/` | Nonce authentication and control-channel wire format |
+| Guest agent | `src/backends/windows_sandbox/guest/` | Runs inside the VM and bridges the child process |
 
 ## Execution Flow
 
-### Single Execution
-
-1. `wxc-exec` verifies Windows Sandbox is enabled, connects to daemon IPC, sends `EXEC {json}\n`
-2. Daemon calls `ensure_sandbox_ready()` — launches sandbox if needed (with up to 3 retries)
-3. Daemon sends `Exec` on the control channel to the agent
-4. Agent spawns `cmd.exe /C <script>`, bridges stdio over TCP
-5. Agent sends `Exit` with exit code on control channel
-6. Daemon reads stdout/stderr, returns `RESULT <code> <stdout-b64> <stderr-b64> <error>\n`
-
-### Multi-Execution (Same Sandbox)
-
-After the first execution, the agent re-accepts fresh data streams via the `StreamsReady` protocol:
-
-1. Agent sends `Exit`, then `StreamsReady` on control channel
-2. Daemon receives `StreamsReady`, connects 3 new TCP streams to the agent
-3. Next `EXEC` request reuses the existing sandbox VM
-
-This avoids the 30-60s boot cost for subsequent executions.
+1. `mxc_engine` validates that Windows Sandbox is experimental-enabled.
+2. The runner validates filesystem and network policy.
+3. A per-session mutex reserves the host's single Windows Sandbox VM slot.
+4. Stale one-shot markers and any provably-owned orphan are reconciled.
+5. The runner creates a secured per-run directory, nonce, bootstrap script, and
+   `.wsb` configuration.
+6. `WindowsSandbox.exe` starts, and the runner records PID-plus-creation-time
+   ownership proof for its host processes.
+7. The guest publishes its address and accepts four authenticated channels:
+   control, stdin, stdout, and stderr.
+8. The guest executes `process.commandLine` through `cmd.exe /C`.
+9. Output and the exit status are returned, then ownership-scoped teardown
+   terminates the VM and confirms it has exited.
+
+Every invocation follows this complete lifecycle; there is no one-shot
+multi-exec or warm-VM reuse.
 
 ## Configuration
 
@@ -73,59 +73,82 @@ This avoids the 30-60s boot cost for subsequent executions.
   "version": "0.6.0-alpha",
   "containment": "windows_sandbox",
   "process": {
-    "commandLine": "python -S -B -c \"print('hello')\"",
+    "commandLine": "powershell -NoProfile -Command \"Write-Output 'hello'\"",
     "timeout": 60000
-  },
-  "experimental": {
-    "windows_sandbox": {
-      "idleTimeoutMs": 300000,
-      "daemonPipeName": "wxc-windows-sandbox"
-    }
   }
 }
 ```
 
-> **Note:** Windows Sandbox is experimental — requires the `--experimental` CLI flag.
-> The `experimental.windows_sandbox` section is optional; defaults are used if omitted.
+The legacy `experimental.windows_sandbox.idleTimeoutMs` and
+`daemonPipeName` fields are still accepted for schema compatibility but are
+ignored by the one-shot backend. A warning is emitted only when either field
+is explicitly changed from its default.
 
-| Field | Default | Description |
-|-------|---------|-------------|
-| `containment` | `"processcontainer"` | Must be `"windows_sandbox"` to use this backend |
-| `process.commandLine` | *(required)* | Command line to execute inside the sandbox |
-| `process.timeout` | `0` (none) | Script execution timeout in milliseconds |
-| `experimental.windows_sandbox.idleTimeoutMs` | `300000` (5 min) | Daemon idle timeout before VM teardown |
-| `experimental.windows_sandbox.daemonPipeName` | `"wxc-windows-sandbox"` | IPC identifier (determines TCP port) |
+## Policy Support
 
-When `containment` is `"windows_sandbox"`, the `processContainer`, `filesystem`, and `network` sections are ignored — isolation is managed by the sandbox VM and guest agent firewall.
+| Policy | Behaviour |
+|---|---|
+| `filesystem.readwritePaths` | Existing host directories are mapped read-write at the same path inside the guest |
+| `filesystem.readonlyPaths` | Existing host directories are mapped read-only at the same path inside the guest |
+| `filesystem.deniedPaths` | Accepted when outside mapped shares; rejected when equal to, inside, or containing a mapped share |
+| Default network policy `block` | Supported through guest firewall lockdown |
+| Default network policy `allow` | Rejected |
+| `allowedHosts` / `blockedHosts` | Rejected; per-host filtering is not supported |
+| Network proxy | Rejected |
+
+Mapped paths must be absolute existing directories. Files, overlapping mapped
+roots, and a path listed as both read-only and read-write are rejected.
 
 ## Security Model
 
-- **VM isolation**: Scripts run inside a separate Windows instance — full OS boundary
-- **Firewall lockdown**: After the agent accepts host connections, it blocks all other network traffic via `netsh advfirewall` rules
-- **Read-only mounts**: Agent binaries and Python are mounted read-only — scripts cannot modify them
-- **Ephemeral**: The sandbox VM is destroyed on teardown — no state persists between sessions
-- **Multi-exec constraint**: VM reuse assumes all scripts come from the same trust domain
+- **VM boundary:** workload code runs in a separate Windows instance.
+- **Authenticated channels:** every TCP connection presents a random
+  per-launch 32-byte nonce and a channel-role byte before protocol traffic.
+- **Role-based pairing:** the guest pairs sockets by declared role rather than
+  TCP accept order.
+- **Network isolation:** the guest permits only the established host
+  connection and blocks other inbound and outbound traffic.
+- **Secured host state:** nonce, rendezvous, and ownership-marker directories
+  use owner-only ACLs and reject roots owned by another user.
+- **Ownership-scoped teardown:** PID-plus-creation-time proof prevents PID reuse
+  or an unrelated Windows Sandbox instance from being treated as owned.
+- **Ephemeral execution:** the VM and per-run marker are removed only after
+  teardown confirms the owned VM has exited.
+
+Same-user processes are within the backend's trust boundary.
 
 ## Prerequisites
 
-| Requirement | How to verify |
+| Requirement | Check |
 |---|---|
-| Windows 11 Pro/Enterprise | `winver` |
-| Windows Sandbox feature enabled | `dism /online /get-featureinfo /featurename:Containers-DisposableClientVM` |
-| Hyper-V / Virtualization enabled | `systeminfo` → "A hypervisor has been detected" |
-| Python 3.x on host (for Python scripts) | `python --version` |
+| Windows 11 Pro, Enterprise, or another edition supporting Windows Sandbox | `winver` |
+| Windows Sandbox optional feature enabled | `Test-Path "$env:WINDIR\System32\WindowsSandbox.exe"` |
+| Hardware virtualisation and Hyper-V support | `systeminfo` |
 
-After enabling Windows Sandbox: **reboot required**.
+Enabling the optional feature requires a reboot. No host Python installation is
+required; workloads can use runtimes already present in the Windows Sandbox
+image or directories explicitly mapped by policy.
 
 ## Known Limitations
 
-1. **IPC uses TCP, not named pipes** — port conflicts possible if another process occupies the derived port
-2. **Single language mapped** — only Python is mapped from host; Node.js would need similar treatment. PowerShell and cmd.exe work out of the box.
-3. **Windows Insider regression** — builds 26100+ have confirmed sandbox boot failures (zombie VM processes)
-4. **Cold boot time** — first sandbox boot takes 15-60s; subsequent executions reuse the VM
-5. **Buffered output** — stdout/stderr are captured and returned after completion, not streamed live
-6. **No filesystem/network policy forwarding** — the `filesystem` and `network` config sections are ignored; isolation relies on the VM boundary and agent firewall
+1. Every invocation pays the Windows Sandbox cold-boot cost.
+2. The host supports only one active Windows Sandbox VM per logon session.
+3. One-shot stdin is buffered and capped at 64 MiB.
+4. Filesystem sharing supports directories only.
+5. Network policy is block-only; allow-lists, block-lists, proxies, and
+   unrestricted outbound access are unsupported.
+6. Output is captured and returned after execution rather than streamed live to
+   the caller.
+
+## Testing
+
+The end-to-end suite requires a Windows host with the Windows Sandbox feature:
+
+```powershell
+.\tests\scripts\run_windows_sandbox_one_shot_tests.ps1
+```
 
 ## Further Reading
 
-See [windows-sandbox-reference.md](windows-sandbox-reference.md) for detailed protocol specs, VM setup internals, debugging guide, source file reference, and E2E test documentation.
+See [windows-sandbox-reference.md](windows-sandbox-reference.md) for protocol,
+VM setup, teardown, debugging, and source-level details.
diff --git a/sdk/node/tests/integration/test-helpers.ts b/sdk/node/tests/integration/test-helpers.ts
index cc188f416..deae57225 100644
--- a/sdk/node/tests/integration/test-helpers.ts
+++ b/sdk/node/tests/integration/test-helpers.ts
@@ -50,7 +50,6 @@ export const EXPECTED_WINDOWS_BINARIES = [
   'wxc-host-prep.exe',
   'winhttp-proxy-shim.exe',
   'wxc-test-proxy.exe',
-  'wxc-windows-sandbox-daemon.exe',
   'wxc-windows-sandbox-guest.exe',
   'mxc-diagnostic-console.exe',
 ];
@@ -67,6 +66,7 @@ export const EXPECTED_MACOS_BINARIES = [
 // Binaries that are optional (feature-gated or only present in certain builds)
 // but still legitimate if found in the package.
 const OPTIONAL_BINARIES = [
+  'wxc-windows-sandbox-daemon.exe', // Built when state-aware Windows Sandbox support is included
   'wslcsdk.dll',   // Only built with --with-wslc
   'plm.exe',       // Permissive Learning Mode helper (Windows-only); staged
                    // only when the plm crate is included in the build.
diff --git a/src/Cargo.lock b/src/Cargo.lock
index 29cb5bd4c..e9bb7ba93 100644
--- a/src/Cargo.lock
+++ b/src/Cargo.lock
@@ -1630,7 +1630,7 @@ dependencies = [
  "seatbelt_common",
  "serde",
  "serde_json",
- "windows_sandbox_common",
+ "windows_sandbox_lifecycle",
  "wslc_common",
  "wxc_common",
 ]
@@ -3070,8 +3070,25 @@ checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 name = "windows_sandbox_common"
 version = "0.7.0"
 dependencies = [
+ "getrandom 0.2.17",
+ "serde",
+ "serde_json",
+ "tokio",
+ "wxc_common",
+]
+
+[[package]]
+name = "windows_sandbox_lifecycle"
+version = "0.7.0"
+dependencies = [
+ "anyhow",
  "serde",
  "serde_json",
+ "tempfile",
+ "tokio",
+ "uuid",
+ "windows",
+ "windows_sandbox_common",
  "wxc_common",
 ]
 
@@ -3319,21 +3336,6 @@ dependencies = [
 name = "wxc_ui_probe"
 version = "0.1.0"
 
-[[package]]
-name = "wxc_windows_sandbox_daemon"
-version = "0.7.0"
-dependencies = [
- "anyhow",
- "mxc_build_common",
- "serde",
- "serde_json",
- "tempfile",
- "tokio",
- "uuid",
- "windows_sandbox_common",
- "wxc_common",
-]
-
 [[package]]
 name = "wxc_windows_sandbox_guest"
 version = "0.7.0"
@@ -3342,6 +3344,7 @@ dependencies = [
  "mxc_build_common",
  "serde_json",
  "tokio",
+ "windows",
  "windows_sandbox_common",
  "wxc_common",
 ]
diff --git a/src/Cargo.toml b/src/Cargo.toml
index dc684cdd6..f4ef321e3 100644
--- a/src/Cargo.toml
+++ b/src/Cargo.toml
@@ -11,9 +11,9 @@ members = [
     "host/plm",
     "core/generated/base_container_specification",
     "backends/appcontainer/common",
-    "backends/windows_sandbox/daemon",
     "backends/windows_sandbox/guest",
     "backends/windows_sandbox/common",
+    "backends/windows_sandbox/lifecycle",
     "backends/isolation_session/bindings",
     "backends/isolation_session/common",
     "backends/hyperlight/common",
@@ -105,6 +105,7 @@ mxc_engine = { path = "core/mxc_engine" }
 mxc-sdk = { path = "core/mxc-sdk" }
 appcontainer_common = { path = "backends/appcontainer/common" }
 windows_sandbox_common = { path = "backends/windows_sandbox/common" }
+windows_sandbox_lifecycle = { path = "backends/windows_sandbox/lifecycle" }
 isolation_session_common = { path = "backends/isolation_session/common" }
 hyperlight_common = { path = "backends/hyperlight/common" }
 nanvix_runner = { path = "backends/nanvix/runner" }
diff --git a/src/backends/windows_sandbox/common/Cargo.toml b/src/backends/windows_sandbox/common/Cargo.toml
index 1fbb07d9b..617a5dd23 100644
--- a/src/backends/windows_sandbox/common/Cargo.toml
+++ b/src/backends/windows_sandbox/common/Cargo.toml
@@ -8,3 +8,5 @@ license.workspace = true
 wxc_common = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
+getrandom = { workspace = true }
+tokio.workspace = true
diff --git a/src/backends/windows_sandbox/common/src/auth.rs b/src/backends/windows_sandbox/common/src/auth.rs
new file mode 100644
index 000000000..3a31939df
--- /dev/null
+++ b/src/backends/windows_sandbox/common/src/auth.rs
@@ -0,0 +1,348 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Per-launch nonce handshake between the host and in-VM guest agent.
+//!
+//! The nonce authenticates each boot/reconnect socket before any protocol
+//! bytes are exchanged, closing the cross-user accept-race window on shared
+//! hosts. Same-user processes remain in the Windows Sandbox trust boundary.
+
+use std::path::Path;
+use std::time::Duration;
+
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::TcpStream;
+
+/// Length in bytes of the per-launch nonce.
+pub const NONCE_LEN_IN_BYTES: usize = 32;
+
+/// Bootstrap file used to pass the launch nonce into the guest.
+pub const NONCE_FILENAME: &str = "nonce.bin";
+
+/// Guest boot timeout for reading [`NONCE_FILENAME`].
+pub const NONCE_READ_TIMEOUT: Duration = Duration::from_secs(15);
+
+/// Per-launch authentication nonce. Intentionally opaque so it is not logged by
+/// derived formatters.
+#[derive(Clone)]
+pub struct Nonce([u8; NONCE_LEN_IN_BYTES]);
+
+/// Logical channel tag written after the nonce. The guest pairs sockets by this
+/// role instead of TCP accept order.
+#[repr(u8)]
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+pub enum ChannelRole {
+    Control = 0,
+    Stdin = 1,
+    Stdout = 2,
+    Stderr = 3,
+}
+
+impl ChannelRole {
+    pub fn from_wire(b: u8) -> Option<Self> {
+        match b {
+            0 => Some(Self::Control),
+            1 => Some(Self::Stdin),
+            2 => Some(Self::Stdout),
+            3 => Some(Self::Stderr),
+            _ => None,
+        }
+    }
+
+    pub fn to_wire(self) -> u8 {
+        self as u8
+    }
+
+    pub fn label(self) -> &'static str {
+        match self {
+            Self::Control => "control",
+            Self::Stdin => "stdin",
+            Self::Stdout => "stdout",
+            Self::Stderr => "stderr",
+        }
+    }
+}
+
+impl Nonce {
+    pub fn from_bytes(bytes: &[u8]) -> Option<Self> {
+        let arr: [u8; NONCE_LEN_IN_BYTES] = bytes.try_into().ok()?;
+        Some(Self(arr))
+    }
+
+    pub fn as_bytes(&self) -> &[u8; NONCE_LEN_IN_BYTES] {
+        &self.0
+    }
+
+    /// Compare two fixed-length nonces without data-dependent early exit.
+    /// Returns `true` only when every byte matches.
+    pub fn constant_time_eq(&self, other: &Nonce) -> bool {
+        let mut diff: u8 = 0;
+        for i in 0..NONCE_LEN_IN_BYTES {
+            diff |= self.0[i] ^ other.0[i];
+        }
+        diff == 0
+    }
+}
+
+/// Generate a fresh per-launch nonce using the OS RNG.
+///
+/// Returns an error instead of panicking if the OS CSPRNG is unavailable, so a
+/// failure on this security-sensitive path is handled by the caller rather than
+/// aborting the process.
+pub fn generate_nonce() -> Result<Nonce, getrandom::Error> {
+    let mut buf = [0u8; NONCE_LEN_IN_BYTES];
+    getrandom::getrandom(&mut buf)?;
+    Ok(Nonce(buf))
+}
+
+/// Reason a nonce + role handshake failed.
+#[derive(Debug)]
+pub enum HandshakeError {
+    Read(std::io::Error),
+    Mismatch,
+    Write(std::io::Error),
+    RoleRead(std::io::Error),
+    RoleUnknown(u8),
+    RoleWrite(std::io::Error),
+}
+
+impl std::fmt::Display for HandshakeError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            HandshakeError::Read(e) => write!(f, "read nonce from peer: {e}"),
+            HandshakeError::Mismatch => write!(f, "peer presented an incorrect nonce"),
+            HandshakeError::Write(e) => write!(f, "write nonce to peer: {e}"),
+            HandshakeError::RoleRead(e) => write!(f, "read role byte from peer: {e}"),
+            HandshakeError::RoleUnknown(b) => {
+                write!(f, "peer declared unknown channel role 0x{b:02x}")
+            }
+            HandshakeError::RoleWrite(e) => write!(f, "write role byte to peer: {e}"),
+        }
+    }
+}
+
+impl std::error::Error for HandshakeError {}
+
+/// Host-side: write the nonce and channel role tag first on a new TCP stream.
+pub async fn write_nonce(
+    stream: &mut TcpStream,
+    nonce: &Nonce,
+    role: ChannelRole,
+) -> Result<(), HandshakeError> {
+    stream
+        .write_all(nonce.as_bytes())
+        .await
+        .map_err(HandshakeError::Write)?;
+    stream
+        .write_all(&[role.to_wire()])
+        .await
+        .map_err(HandshakeError::RoleWrite)
+}
+
+/// Guest-side: authenticate a new TCP stream and decode its channel role.
+pub async fn verify_nonce(
+    stream: &mut TcpStream,
+    expected: &Nonce,
+) -> Result<ChannelRole, HandshakeError> {
+    let mut buf = [0u8; NONCE_LEN_IN_BYTES];
+    stream
+        .read_exact(&mut buf)
+        .await
+        .map_err(HandshakeError::Read)?;
+    let got = Nonce::from_bytes(&buf)
+        .expect("read_exact filled the nonce buffer, Nonce::from_bytes must succeed");
+    if !expected.constant_time_eq(&got) {
+        return Err(HandshakeError::Mismatch);
+    }
+    let mut role_buf = [0u8; 1];
+    stream
+        .read_exact(&mut role_buf)
+        .await
+        .map_err(HandshakeError::RoleRead)?;
+    ChannelRole::from_wire(role_buf[0]).ok_or(HandshakeError::RoleUnknown(role_buf[0]))
+}
+
+/// Host-side: create the nonce file in an already-secured rendezvous directory.
+pub fn write_nonce_file(dir: &Path, nonce: &Nonce) -> std::io::Result<()> {
+    let path = dir.join(NONCE_FILENAME);
+    match std::fs::remove_file(&path) {
+        Ok(()) => {}
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+        Err(e) => return Err(e),
+    }
+    std::fs::write(path, nonce.as_bytes())
+}
+
+/// Guest-side: read and delete the nonce file.
+pub async fn read_and_consume_nonce_file(dir: &Path, timeout: Duration) -> std::io::Result<Nonce> {
+    let path = dir.join(NONCE_FILENAME);
+    let deadline = tokio::time::Instant::now() + timeout;
+    loop {
+        match tokio::fs::read(&path).await {
+            Ok(bytes) => {
+                // Delete before validation so a malformed file is not retried forever.
+                let delete_err = tokio::fs::remove_file(&path).await.err();
+                let nonce = Nonce::from_bytes(&bytes).ok_or_else(|| {
+                    std::io::Error::new(
+                        std::io::ErrorKind::InvalidData,
+                        format!(
+                            "nonce file {path:?} is {} bytes, expected {NONCE_LEN_IN_BYTES}",
+                            bytes.len()
+                        ),
+                    )
+                })?;
+                if let Some(e) = delete_err {
+                    // Best-effort: the nonce has already been read into memory.
+                    eprintln!(
+                        "[guest][auth] WARNING: nonce file {path:?} delete after read failed: {e}"
+                    );
+                }
+                return Ok(nonce);
+            }
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+                if tokio::time::Instant::now() >= deadline {
+                    return Err(std::io::Error::new(
+                        std::io::ErrorKind::NotFound,
+                        format!(
+                            "nonce file {path:?} did not appear within {timeout:?}; check the \
+                             host wrote it before launching the VM"
+                        ),
+                    ));
+                }
+                tokio::time::sleep(Duration::from_millis(50)).await;
+            }
+            Err(e) => return Err(e),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn from_bytes_requires_exact_length() {
+        assert!(Nonce::from_bytes(&[0u8; NONCE_LEN_IN_BYTES]).is_some());
+        assert!(Nonce::from_bytes(&[0u8; NONCE_LEN_IN_BYTES - 1]).is_none());
+        assert!(Nonce::from_bytes(&[0u8; NONCE_LEN_IN_BYTES + 1]).is_none());
+        assert!(Nonce::from_bytes(&[]).is_none());
+    }
+
+    #[test]
+    fn constant_time_eq_matches_equal_bytes() {
+        let a = Nonce::from_bytes(&[0xAA; NONCE_LEN_IN_BYTES]).unwrap();
+        let b = Nonce::from_bytes(&[0xAA; NONCE_LEN_IN_BYTES]).unwrap();
+        assert!(a.constant_time_eq(&b));
+    }
+
+    #[test]
+    fn constant_time_eq_rejects_one_bit_diff() {
+        let a_bytes = [0xAA; NONCE_LEN_IN_BYTES];
+        let mut b_bytes = a_bytes;
+        b_bytes[NONCE_LEN_IN_BYTES - 1] ^= 0x01;
+        let a = Nonce::from_bytes(&a_bytes).unwrap();
+        let b = Nonce::from_bytes(&b_bytes).unwrap();
+        assert!(!a.constant_time_eq(&b));
+    }
+
+    #[test]
+    fn constant_time_eq_rejects_total_mismatch() {
+        let a = Nonce::from_bytes(&[0x00; NONCE_LEN_IN_BYTES]).unwrap();
+        let b = Nonce::from_bytes(&[0xFF; NONCE_LEN_IN_BYTES]).unwrap();
+        assert!(!a.constant_time_eq(&b));
+    }
+
+    #[test]
+    fn channel_role_roundtrip() {
+        for role in [
+            ChannelRole::Control,
+            ChannelRole::Stdin,
+            ChannelRole::Stdout,
+            ChannelRole::Stderr,
+        ] {
+            assert_eq!(ChannelRole::from_wire(role.to_wire()), Some(role));
+        }
+    }
+
+    #[test]
+    fn channel_role_rejects_unknown_wire_bytes() {
+        for b in [4u8, 5, 7, 0x10, 0x80, 0xFE, 0xFF] {
+            assert!(ChannelRole::from_wire(b).is_none(), "byte {b:#x} accepted");
+        }
+    }
+
+    #[test]
+    fn channel_role_label_is_stable() {
+        // The bridge logs use these labels; diagnostics depend on them being
+        // canonical.
+        assert_eq!(ChannelRole::Control.label(), "control");
+        assert_eq!(ChannelRole::Stdin.label(), "stdin");
+        assert_eq!(ChannelRole::Stdout.label(), "stdout");
+        assert_eq!(ChannelRole::Stderr.label(), "stderr");
+    }
+
+    #[test]
+    fn generated_nonces_differ_with_overwhelming_probability() {
+        // 256 bits of OS entropy; a collision across 1024 draws has probability
+        // ~2^-237, indistinguishable from impossible. We just assert two
+        // sequential generations differ (catches a wholly broken RNG that
+        // returns a constant).
+        let a = generate_nonce().unwrap();
+        let b = generate_nonce().unwrap();
+        assert!(!a.constant_time_eq(&b));
+    }
+
+    /// The per-launch `nonce.bin` written into an owner-only rendezvous dir
+    /// is itself owner-only (so a cross-user reader cannot recover the nonce),
+    /// and is **deleted on read** by the guest-side consume (bounding in-VM
+    /// exposure to the running guest process's memory).
+    #[cfg(windows)]
+    #[test]
+    fn nonce_file_is_owner_only_and_deleted_after_read() {
+        let unique = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap()
+            .as_nanos();
+        let dir = std::env::temp_dir().join(format!(
+            "wxc-wsb-noncetest-{}-{}",
+            std::process::id(),
+            unique
+        ));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).expect("create temp dir");
+        // Secure the dir owner-only + inheritable, mirroring how the launch path
+        // prepares the rendezvous dir before writing the nonce.
+        wxc_common::filesystem_dacl::set_owner_only_dacl(&dir, true).expect("secure dir");
+
+        let nonce = generate_nonce().expect("generate nonce");
+        write_nonce_file(&dir, &nonce).expect("write nonce file");
+
+        let path = dir.join(NONCE_FILENAME);
+        assert!(path.exists(), "nonce file must exist after write");
+        // Created fresh inside the owner-only dir, the file is owned by us; a
+        // cross-user reader cannot open it.
+        assert!(
+            wxc_common::filesystem_dacl::owner_is_self(&path).expect("read owner"),
+            "nonce.bin must be owned by us (inherited owner-only DACL)"
+        );
+
+        // Reading consumes (deletes) the file.
+        let rt = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .expect("build runtime");
+        let read = rt
+            .block_on(read_and_consume_nonce_file(
+                &dir,
+                std::time::Duration::from_secs(5),
+            ))
+            .expect("read nonce");
+        assert!(
+            read.constant_time_eq(&nonce),
+            "round-tripped nonce must match"
+        );
+        assert!(!path.exists(), "nonce.bin must be deleted after read");
+
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}
diff --git a/src/backends/windows_sandbox/common/src/lib.rs b/src/backends/windows_sandbox/common/src/lib.rs
index f0e4507e8..3f0cc8b1b 100644
--- a/src/backends/windows_sandbox/common/src/lib.rs
+++ b/src/backends/windows_sandbox/common/src/lib.rs
@@ -5,7 +5,5 @@
 //! `wxc-windows-sandbox-daemon` host process, and the
 //! `wxc-windows-sandbox-guest` agent inside the VM.
 
+pub mod auth;
 pub mod sandbox_protocol;
-
-#[cfg(target_os = "windows")]
-pub mod windows_sandbox_runner;
diff --git a/src/backends/windows_sandbox/common/src/sandbox_protocol.rs b/src/backends/windows_sandbox/common/src/sandbox_protocol.rs
index 92943bdc4..496ef030c 100644
--- a/src/backends/windows_sandbox/common/src/sandbox_protocol.rs
+++ b/src/backends/windows_sandbox/common/src/sandbox_protocol.rs
@@ -121,6 +121,81 @@ pub fn decode_message(buf: &[u8]) -> Result<DecodeResult, serde_json::Error> {
     })
 }
 
+// ---------------------------------------------------------------------------
+// Connection preamble (control-channel handshake)
+// ---------------------------------------------------------------------------
+
+/// Magic bytes the guest agent writes first on the control channel.
+///
+/// Lets the host fail fast (rather than hanging or misframing) if it connects
+/// to something that is not a matching guest agent.
+pub const PROTOCOL_MAGIC: [u8; 4] = *b"WSBP";
+
+/// Compatibility version for the host/guest control-channel wire protocol.
+///
+/// The host injects the guest binary, so in normal operation both sides are
+/// always the same build; the version guards against a stale guest left over
+/// from an incompatible image and makes mismatches diagnosable. Bump this only
+/// for incompatible changes to framing, preamble semantics, or required control
+/// messages. A mismatch rejects the connection before any framed messages run.
+pub const PROTOCOL_VERSION: u32 = 1;
+
+/// Length in bytes of the fixed control-channel preamble (4 magic + 4 version).
+pub const PREAMBLE_LEN: usize = 8;
+
+/// Reason an 8-byte control preamble was rejected.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum PreambleError {
+    /// The first four bytes did not match [`PROTOCOL_MAGIC`].
+    BadMagic([u8; 4]),
+    /// The magic matched but the peer's version differed from [`PROTOCOL_VERSION`].
+    VersionMismatch { expected: u32, actual: u32 },
+}
+
+impl std::fmt::Display for PreambleError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            PreambleError::BadMagic(got) => write!(
+                f,
+                "bad protocol magic: expected {:?}, got {:?}",
+                PROTOCOL_MAGIC, got
+            ),
+            PreambleError::VersionMismatch { expected, actual } => write!(
+                f,
+                "protocol version mismatch: expected {}, got {}",
+                expected, actual
+            ),
+        }
+    }
+}
+
+impl std::error::Error for PreambleError {}
+
+/// Encode the fixed control-channel preamble the guest sends before `Ready`.
+pub fn encode_preamble() -> [u8; PREAMBLE_LEN] {
+    let mut bytes = [0u8; PREAMBLE_LEN];
+    bytes[..4].copy_from_slice(&PROTOCOL_MAGIC);
+    bytes[4..].copy_from_slice(&PROTOCOL_VERSION.to_le_bytes());
+    bytes
+}
+
+/// Validate an 8-byte preamble, returning the peer's protocol version.
+pub fn validate_preamble(bytes: &[u8; PREAMBLE_LEN]) -> Result<u32, PreambleError> {
+    let mut magic = [0u8; 4];
+    magic.copy_from_slice(&bytes[..4]);
+    if magic != PROTOCOL_MAGIC {
+        return Err(PreambleError::BadMagic(magic));
+    }
+    let actual = u32::from_le_bytes([bytes[4], bytes[5], bytes[6], bytes[7]]);
+    if actual != PROTOCOL_VERSION {
+        return Err(PreambleError::VersionMismatch {
+            expected: PROTOCOL_VERSION,
+            actual,
+        });
+    }
+    Ok(actual)
+}
+
 // ---------------------------------------------------------------------------
 // Daemon IPC result (line-based protocol between wxc-exec and daemon)
 // ---------------------------------------------------------------------------
@@ -225,6 +300,38 @@ mod tests {
         );
     }
 
+    #[test]
+    fn preamble_roundtrip() {
+        let bytes = encode_preamble();
+        assert_eq!(bytes.len(), PREAMBLE_LEN);
+        assert_eq!(&bytes[..4], &PROTOCOL_MAGIC);
+        assert_eq!(validate_preamble(&bytes).unwrap(), PROTOCOL_VERSION);
+    }
+
+    #[test]
+    fn preamble_rejects_bad_magic() {
+        let mut bytes = encode_preamble();
+        bytes[0] ^= 0xFF;
+        match validate_preamble(&bytes) {
+            Err(PreambleError::BadMagic(_)) => {}
+            other => panic!("expected BadMagic, got {:?}", other),
+        }
+    }
+
+    #[test]
+    fn preamble_rejects_version_mismatch() {
+        let mut bytes = encode_preamble();
+        let bad = PROTOCOL_VERSION.wrapping_add(1);
+        bytes[4..].copy_from_slice(&bad.to_le_bytes());
+        match validate_preamble(&bytes) {
+            Err(PreambleError::VersionMismatch { expected, actual }) => {
+                assert_eq!(expected, PROTOCOL_VERSION);
+                assert_eq!(actual, bad);
+            }
+            other => panic!("expected VersionMismatch, got {:?}", other),
+        }
+    }
+
     #[test]
     fn roundtrip_exec() {
         let msg = ControlMessage::Exec(ExecRequest {
diff --git a/src/backends/windows_sandbox/common/src/windows_sandbox_runner.rs b/src/backends/windows_sandbox/common/src/windows_sandbox_runner.rs
deleted file mode 100644
index 71a335c0f..000000000
--- a/src/backends/windows_sandbox/common/src/windows_sandbox_runner.rs
+++ /dev/null
@@ -1,266 +0,0 @@
-//! `WindowsSandboxScriptRunner` — executes scripts via the Windows Sandbox daemon.
-//!
-//! When `wxc-exec` is configured with `"containment": "windows_sandbox"`, this runner
-//! connects to the sandbox daemon's IPC server, sends an EXEC request, and
-//! returns the exit code.  If the daemon isn't running it is auto-launched.
-
-use std::io::{BufRead, BufReader, Write};
-use std::net::TcpStream;
-use std::time::Duration;
-
-use wxc_common::logger::Logger;
-use wxc_common::models::{ExecutionRequest, ScriptResponse, WindowsSandboxConfig};
-use wxc_common::process_util::resolve_sibling_binary;
-use wxc_common::script_runner::ScriptRunner;
-
-use crate::sandbox_protocol::DaemonResult;
-
-/// Script runner that delegates execution to the Windows Sandbox daemon.
-pub struct WindowsSandboxScriptRunner {
-    config: WindowsSandboxConfig,
-}
-
-impl WindowsSandboxScriptRunner {
-    pub fn new(config: &WindowsSandboxConfig) -> Self {
-        Self {
-            config: config.clone(),
-        }
-    }
-
-    /// Deterministic port derived from the pipe name (matches daemon logic).
-    fn pipe_name_to_port(name: &str) -> u16 {
-        let hash: u32 = name
-            .bytes()
-            .fold(0u32, |acc, b| acc.wrapping_mul(31).wrapping_add(b as u32));
-        let range = 65535u32 - 49152;
-        (49152 + (hash % range)) as u16
-    }
-
-    /// Try to connect to the daemon's IPC server.
-    fn connect_to_daemon(&self) -> Result<TcpStream, String> {
-        let port = Self::pipe_name_to_port(&self.config.daemon_pipe_name);
-        let addr = format!("127.0.0.1:{}", port);
-
-        TcpStream::connect_timeout(
-            &addr.parse().map_err(|e| format!("bad addr: {}", e))?,
-            Duration::from_secs(5),
-        )
-        .map_err(|e| format!("connect to daemon at {}: {}", addr, e))
-    }
-
-    /// Locate the daemon executable next to wxc-exec.
-    fn daemon_exe_path() -> Result<std::path::PathBuf, String> {
-        resolve_sibling_binary("wxc-windows-sandbox-daemon.exe").map_err(|e| e.to_string())
-    }
-
-    /// Launch the daemon process if it's not already running.
-    fn ensure_daemon_running(&self, logger: &mut Logger) -> Result<(), String> {
-        // First, try to connect — if it works, daemon is already running.
-        if self.connect_to_daemon().is_ok() {
-            return Ok(());
-        }
-
-        logger.log_line("Sandbox daemon not running, launching...");
-
-        let daemon_path = Self::daemon_exe_path()?;
-        let idle_timeout = self.config.idle_timeout_ms.to_string();
-
-        // Launch daemon as a detached background process.
-        std::process::Command::new(&daemon_path)
-            .arg(&self.config.daemon_pipe_name)
-            .arg(&idle_timeout)
-            .stdin(std::process::Stdio::null())
-            .stdout(std::process::Stdio::null())
-            .stderr(std::process::Stdio::null())
-            .spawn()
-            .map_err(|e| format!("spawn daemon: {}", e))?;
-
-        // Poll until the daemon's IPC port is reachable.
-        let deadline = std::time::Instant::now() + Duration::from_secs(120);
-        loop {
-            if std::time::Instant::now() >= deadline {
-                return Err("timed out waiting for daemon to start".to_string());
-            }
-            std::thread::sleep(Duration::from_millis(500));
-            if self.connect_to_daemon().is_ok() {
-                logger.log_line("Sandbox daemon is now running");
-                return Ok(());
-            }
-        }
-    }
-
-    /// Check if Windows Sandbox is available on this system.
-    fn check_sandbox_available() -> Result<(), String> {
-        let output = std::process::Command::new("dism")
-            .args([
-                "/online",
-                "/get-featureinfo",
-                "/featurename:Containers-DisposableClientVM",
-            ])
-            .stdout(std::process::Stdio::piped())
-            .stderr(std::process::Stdio::null())
-            .output()
-            .map_err(|err| format!("failed to run dism: {}", err))?;
-
-        let stdout = String::from_utf8_lossy(&output.stdout);
-        if stdout.contains("State : Enabled") {
-            Ok(())
-        } else {
-            Err(
-                "Windows Sandbox is not enabled. \
-                 Run 'dism /online /enable-feature /featurename:Containers-DisposableClientVM /all' \
-                 and reboot."
-                    .to_string(),
-            )
-        }
-    }
-
-    /// Send an execution request to the daemon and read the result.
-    fn execute_via_daemon(
-        &self,
-        request: &ExecutionRequest,
-        logger: &mut Logger,
-    ) -> ScriptResponse {
-        // Pre-flight: verify Windows Sandbox is available.
-        if let Err(err) = Self::check_sandbox_available() {
-            return ScriptResponse::error(&err);
-        }
-
-        // Ensure daemon is up.
-        if let Err(err) = self.ensure_daemon_running(logger) {
-            return ScriptResponse::error(&err);
-        }
-
-        // Connect.
-        let mut stream = match self.connect_to_daemon() {
-            Ok(stream) => stream,
-            Err(err) => return ScriptResponse::error(&err),
-        };
-
-        // Send EXEC request as a single line: "EXEC <json>\n"
-        let payload = IpcExecRequest {
-            script_code: request.script_code.clone(),
-            working_directory: request.working_directory.clone(),
-            timeout_ms: request.script_timeout,
-        };
-        let json = match serde_json::to_string(&payload) {
-            Ok(json) => json,
-            Err(err) => return ScriptResponse::error(&format!("serialize request: {}", err)),
-        };
-
-        let msg = format!("EXEC {}\n", json);
-        if let Err(err) = stream.write_all(msg.as_bytes()) {
-            return ScriptResponse::error(&format!("send to daemon: {}", err));
-        }
-
-        let mut reader = BufReader::new(&stream);
-        let mut response_line = String::new();
-        if let Err(err) = reader.read_line(&mut response_line) {
-            return ScriptResponse::error(&format!("read daemon response: {}", err));
-        }
-
-        Self::parse_daemon_response(response_line.trim())
-    }
-
-    /// Parse the daemon's response line into a `ScriptResponse`.
-    fn parse_daemon_response(response_line: &str) -> ScriptResponse {
-        if response_line.starts_with("RESULT ") {
-            match DaemonResult::parse(response_line) {
-                Ok(result) => {
-                    // Lossy decode: the daemon transports raw bytes, so a
-                    // single invalid UTF-8 byte must not discard the entire
-                    // stream (which `String::from_utf8(...).unwrap_or_default()`
-                    // would do). Replace invalid sequences with U+FFFD instead.
-                    let stdout_text = String::from_utf8_lossy(&result.stdout).into_owned();
-                    let stderr_text = String::from_utf8_lossy(&result.stderr).into_owned();
-                    ScriptResponse {
-                        exit_code: result.exit_code,
-                        standard_out: stdout_text,
-                        standard_err: stderr_text.clone(),
-                        error_message: if result.error_message.is_empty() {
-                            stderr_text
-                        } else {
-                            result.error_message
-                        },
-                        ..Default::default()
-                    }
-                }
-                Err(err) => ScriptResponse::error(&err),
-            }
-        } else if let Some(stripped) = response_line.strip_prefix("ERROR ") {
-            ScriptResponse::error(stripped)
-        } else {
-            ScriptResponse::error(&format!("unexpected daemon response: {}", response_line))
-        }
-    }
-}
-
-impl ScriptRunner for WindowsSandboxScriptRunner {
-    fn execute(&mut self, request: &ExecutionRequest, logger: &mut Logger) -> ScriptResponse {
-        self.execute_via_daemon(request, logger)
-    }
-}
-
-/// JSON payload sent to the daemon over the IPC channel.
-#[derive(serde::Serialize)]
-struct IpcExecRequest {
-    script_code: String,
-    working_directory: String,
-    timeout_ms: u32,
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn pipe_name_to_port_deterministic() {
-        let p1 = WindowsSandboxScriptRunner::pipe_name_to_port("wxc-windows-sandbox");
-        let p2 = WindowsSandboxScriptRunner::pipe_name_to_port("wxc-windows-sandbox");
-        assert_eq!(p1, p2);
-        assert!(p1 >= 49152);
-    }
-
-    #[test]
-    fn pipe_name_to_port_matches_daemon() {
-        // Must produce the same port as the daemon's pipe_name_to_port.
-        fn daemon_pipe_name_to_port(name: &str) -> u16 {
-            let hash: u32 = name
-                .bytes()
-                .fold(0u32, |acc, b| acc.wrapping_mul(31).wrapping_add(b as u32));
-            let range = 65535u32 - 49152;
-            (49152 + (hash % range)) as u16
-        }
-        assert_eq!(
-            WindowsSandboxScriptRunner::pipe_name_to_port("wxc-windows-sandbox"),
-            daemon_pipe_name_to_port("wxc-windows-sandbox")
-        );
-        assert_eq!(
-            WindowsSandboxScriptRunner::pipe_name_to_port("custom-pipe"),
-            daemon_pipe_name_to_port("custom-pipe")
-        );
-    }
-
-    #[test]
-    fn parse_daemon_response_preserves_non_utf8_output() {
-        // A single invalid UTF-8 byte must not discard the whole stream.
-        let line = DaemonResult {
-            exit_code: 0,
-            stdout: vec![b'h', b'i', 0xFF, b'!'],
-            stderr: vec![0xFE, b'e', b'r', b'r'],
-            error_message: String::new(),
-        }
-        .to_line();
-
-        let resp = WindowsSandboxScriptRunner::parse_daemon_response(line.trim());
-
-        assert_eq!(resp.exit_code, 0);
-        // U+FFFD replacement char is kept; the surrounding bytes survive.
-        assert!(resp.standard_out.contains("hi"));
-        assert!(resp.standard_out.contains('!'));
-        assert!(resp.standard_out.contains('\u{FFFD}'));
-        assert!(resp.standard_err.contains("err"));
-        // error_message falls back to stderr text when empty.
-        assert!(resp.error_message.contains("err"));
-    }
-}
diff --git a/src/backends/windows_sandbox/guest/Cargo.toml b/src/backends/windows_sandbox/guest/Cargo.toml
index e2da48c3e..c9dad5cdf 100644
--- a/src/backends/windows_sandbox/guest/Cargo.toml
+++ b/src/backends/windows_sandbox/guest/Cargo.toml
@@ -14,6 +14,10 @@ windows_sandbox_common = { workspace = true }
 tokio.workspace = true
 serde_json.workspace = true
 anyhow.workspace = true
+windows.workspace = true
+
+[dev-dependencies]
+tokio = { workspace = true, features = ["test-util"] }
 
 [build-dependencies]
 mxc_build_common.workspace = true
diff --git a/src/backends/windows_sandbox/guest/src/executor.rs b/src/backends/windows_sandbox/guest/src/executor.rs
index 062d2e90c..4c44f820c 100644
--- a/src/backends/windows_sandbox/guest/src/executor.rs
+++ b/src/backends/windows_sandbox/guest/src/executor.rs
@@ -9,25 +9,31 @@ use tokio::net::{TcpListener, TcpStream};
 use tokio::process::Command;
 
 use windows_sandbox_common::sandbox_protocol::{
-    decode_message, encode_message, ControlMessage, DecodeResult, ExecRequest, ExitNotification,
+    decode_message, encode_message, encode_preamble, ControlMessage, DecodeResult, ExecRequest,
+    ExitNotification,
 };
 
-/// Main command loop.  Reads control messages from the host and executes
-/// scripts until the control connection is closed.  After each execution,
-/// re-accepts fresh data connections so the next EXEC has usable streams.
-///
-/// TODO: Multi-exec reuses the same VM, so a previous script's side
-/// effects (files, processes, registry, env changes) persist. Consider
-/// killing orphan processes and cleaning temp directories between
-/// executions to limit cross-execution state leakage.
+use crate::job::Job;
+
+/// Backstop budget for stdio bridge drain after child exit.
+const BRIDGE_DRAIN_GRACE: std::time::Duration = std::time::Duration::from_secs(10);
+
+/// Main command loop.
 pub async fn run_command_loop(
     mut control: TcpStream,
     stdin_stream: TcpStream,
     stdout_stream: TcpStream,
     stderr_stream: TcpStream,
     listener: &TcpListener,
+    expected_nonce: &windows_sandbox_common::auth::Nonce,
 ) -> Result<()> {
-    // Signal readiness to the host.
+    // Announce the protocol magic + version so the host can fail fast on a
+    // version/identity mismatch before any framed messages are exchanged.
+    control
+        .write_all(&encode_preamble())
+        .await
+        .context("send preamble")?;
+
     let ready_frame = encode_message(&ControlMessage::Ready).context("encode Ready")?;
     control
         .write_all(&ready_frame)
@@ -42,7 +48,6 @@ pub async fn run_command_loop(
     let mut tmp = [0u8; 4096];
 
     loop {
-        // Read from control channel.
         let bytes_read = control.read(&mut tmp).await.context("read control")?;
         if bytes_read == 0 {
             eprintln!("[guest] control connection closed");
@@ -50,7 +55,6 @@ pub async fn run_command_loop(
         }
         buf.extend_from_slice(&tmp[..bytes_read]);
 
-        // Try to decode a complete message.
         loop {
             match decode_message(&buf).context("decode control message")? {
                 DecodeResult::Incomplete => break,
@@ -58,7 +62,12 @@ pub async fn run_command_loop(
                     buf.drain(..consumed);
                     match message {
                         ControlMessage::Exec(req) => {
-                            eprintln!("[guest] exec {}: {}", req.exec_id, req.script_code);
+                            // Do not log raw script_code; it may contain secrets.
+                            eprintln!(
+                                "[guest] exec {} ({} bytes)",
+                                req.exec_id,
+                                req.script_code.len()
+                            );
 
                             handle_exec(
                                 &req,
@@ -69,11 +78,8 @@ pub async fn run_command_loop(
                             )
                             .await?;
 
-                            // Re-accept fresh data connections for the next
-                            // execution. The listener is already bound so the
-                            // daemon's connects queue in the TCP backlog.
                             let (new_stdin, new_stdout, new_stderr) =
-                                reconnect_streams(&mut control, listener).await?;
+                                reconnect_streams(&mut control, listener, expected_nonce).await?;
                             current_stdin = new_stdin;
                             current_stdout = new_stdout;
                             current_stderr = new_stderr;
@@ -135,6 +141,7 @@ async fn handle_exec(
 async fn reconnect_streams(
     control: &mut TcpStream,
     listener: &TcpListener,
+    expected_nonce: &windows_sandbox_common::auth::Nonce,
 ) -> Result<(TcpStream, TcpStream, TcpStream)> {
     let ready_frame =
         encode_message(&ControlMessage::StreamsReady).context("encode StreamsReady")?;
@@ -144,13 +151,40 @@ async fn reconnect_streams(
         .context("send StreamsReady")?;
     eprintln!("[guest] StreamsReady sent, accepting new data connections");
 
-    let streams = crate::listener::accept_data_connections(listener)
+    let streams = crate::listener::accept_data_connections(listener, expected_nonce)
         .await
         .context("re-accept data connections")?;
     eprintln!("[guest] new data connections accepted, ready for next exec");
     Ok(streams)
 }
 
+/// Forcibly terminate a process and descendants.
+async fn kill_process_tree(pid: Option<u32>) {
+    let Some(pid) = pid else {
+        eprintln!("[guest] cannot tree-kill: child pid unavailable");
+        return;
+    };
+    let killed = tokio::time::timeout(
+        std::time::Duration::from_secs(5),
+        Command::new("taskkill")
+            .args(["/T", "/F", "/PID", &pid.to_string()])
+            .kill_on_drop(true)
+            .output(),
+    )
+    .await;
+    match killed {
+        Ok(Ok(out)) if out.status.success() => {}
+        Ok(Ok(out)) => eprintln!(
+            "[guest] taskkill tree-kill of pid {} returned {}: {}",
+            pid,
+            out.status,
+            String::from_utf8_lossy(&out.stderr).trim()
+        ),
+        Ok(Err(err)) => eprintln!("[guest] failed to run taskkill for pid {}: {}", pid, err),
+        Err(_) => eprintln!("[guest] taskkill for pid {} timed out after 5s", pid),
+    }
+}
+
 /// Spawn a child process and bridge its stdio over the TCP streams.
 async fn execute_script(
     script_code: &str,
@@ -160,9 +194,7 @@ async fn execute_script(
     stdout_stream: TcpStream,
     stderr_stream: TcpStream,
 ) -> Result<i32> {
-    // Use raw_arg to pass the script literally to cmd.exe.
-    // Rust's standard arg() escaping conflicts with cmd.exe's quoting rules,
-    // so we pass /C normally and the script code unescaped.
+    // raw_arg preserves cmd.exe quoting.
     let mut cmd = Command::new("cmd.exe");
     cmd.arg("/C");
     cmd.raw_arg(script_code);
@@ -176,6 +208,23 @@ async fn execute_script(
     cmd.stderr(std::process::Stdio::piped());
 
     let mut child = cmd.spawn().context("spawn child process")?;
+    let child_pid = child.id();
+
+    // Best-effort job object cleanup for child descendants.
+    let job = match Job::new() {
+        Ok(j) => {
+            if let Some(pid) = child_pid {
+                if let Err(err) = j.assign(pid) {
+                    eprintln!("[guest] could not assign child to job (continuing): {err:#}");
+                }
+            }
+            Some(j)
+        }
+        Err(err) => {
+            eprintln!("[guest] could not create job object (continuing): {err:#}");
+            None
+        }
+    };
 
     // Take child stdio handles.
     let child_stdin = child.stdin.take();
@@ -183,8 +232,9 @@ async fn execute_script(
     let child_stderr = child.stderr.take();
 
     // Bridge stdin: TCP → child
-    let stdin_task = tokio::spawn(async move {
+    let mut stdin_task = tokio::spawn(async move {
         if let (mut tcp, Some(mut child_in)) = (stdin_stream, child_stdin) {
+            let _ = tcp.set_nodelay(true);
             if let Err(err) = tokio::io::copy(&mut tcp, &mut child_in).await {
                 eprintln!("[guest] stdin bridge error: {}", err);
             }
@@ -192,20 +242,28 @@ async fn execute_script(
     });
 
     // Bridge stdout: child → TCP
-    let stdout_task = tokio::spawn(async move {
+    let mut stdout_task = tokio::spawn(async move {
         if let (mut tcp, Some(mut child_out)) = (stdout_stream, child_stdout) {
+            let _ = tcp.set_nodelay(true);
             if let Err(err) = tokio::io::copy(&mut child_out, &mut tcp).await {
                 eprintln!("[guest] stdout bridge error: {}", err);
             }
+            if let Err(err) = tcp.shutdown().await {
+                eprintln!("[guest] stdout shutdown error: {}", err);
+            }
         }
     });
 
     // Bridge stderr: child → TCP
-    let stderr_task = tokio::spawn(async move {
+    let mut stderr_task = tokio::spawn(async move {
         if let (mut tcp, Some(mut child_err)) = (stderr_stream, child_stderr) {
+            let _ = tcp.set_nodelay(true);
             if let Err(err) = tokio::io::copy(&mut child_err, &mut tcp).await {
                 eprintln!("[guest] stderr bridge error: {}", err);
             }
+            if let Err(err) = tcp.shutdown().await {
+                eprintln!("[guest] stderr shutdown error: {}", err);
+            }
         }
     });
 
@@ -218,6 +276,10 @@ async fn execute_script(
             Ok(Ok(status)) => status,
             Ok(Err(err)) => anyhow::bail!("wait failed: {}", err),
             Err(_) => {
+                match &job {
+                    Some(j) => j.terminate(),
+                    None => kill_process_tree(child_pid).await,
+                }
                 if let Err(err) = child.kill().await {
                     eprintln!("[guest] failed to kill timed-out process: {}", err);
                 }
@@ -226,19 +288,36 @@ async fn execute_script(
         }
     };
 
-    // Wait for bridge tasks to complete (they'll finish when the child exits
-    // and its stdio handles are closed). Task join errors indicate panics
-    // in the bridge tasks, which should not happen but we log them.
-    let (stdin_result, stdout_result, stderr_result) =
-        tokio::join!(stdin_task, stdout_task, stderr_task);
-    if let Err(err) = stdin_result {
-        eprintln!("[guest] stdin bridge task failed: {}", err);
-    }
-    if let Err(err) = stdout_result {
-        eprintln!("[guest] stdout bridge task failed: {}", err);
+    if let Some(j) = &job {
+        j.terminate();
     }
-    if let Err(err) = stderr_result {
-        eprintln!("[guest] stderr bridge task failed: {}", err);
+
+    // Bound the drain so a pipe-holding descendant cannot wedge the guest.
+    let drain = tokio::time::timeout(BRIDGE_DRAIN_GRACE, async {
+        tokio::join!(&mut stdin_task, &mut stdout_task, &mut stderr_task)
+    })
+    .await;
+    match drain {
+        Ok((stdin_result, stdout_result, stderr_result)) => {
+            if let Err(err) = stdin_result {
+                eprintln!("[guest] stdin bridge task failed: {}", err);
+            }
+            if let Err(err) = stdout_result {
+                eprintln!("[guest] stdout bridge task failed: {}", err);
+            }
+            if let Err(err) = stderr_result {
+                eprintln!("[guest] stderr bridge task failed: {}", err);
+            }
+        }
+        Err(_) => {
+            eprintln!(
+                "[guest] bridge drain timed out after {:?}; aborting stdio relay (possible leaked descendant holding the pipes)",
+                BRIDGE_DRAIN_GRACE
+            );
+            stdin_task.abort();
+            stdout_task.abort();
+            stderr_task.abort();
+        }
     }
 
     Ok(exit_status.code().unwrap_or(-1))
diff --git a/src/backends/windows_sandbox/guest/src/firewall.rs b/src/backends/windows_sandbox/guest/src/firewall.rs
index 954ad76f8..977ffda60 100644
--- a/src/backends/windows_sandbox/guest/src/firewall.rs
+++ b/src/backends/windows_sandbox/guest/src/firewall.rs
@@ -8,23 +8,43 @@ use std::net::IpAddr;
 use anyhow::{Context, Result};
 use tokio::process::Command;
 
-/// Lock down the Windows Firewall inside the sandbox so that only the
-/// already-established host connections survive.
-///
-/// 1. Delete all existing rules.
-/// 2. Allow inbound on our listen port from the host IP.
-/// 3. Allow outbound to the host IP.
-/// 4. Set default policy to block-all for both directions.
+/// Pre-authorise the agent by program path before bind so an inbound firewall
+/// prompt cannot block unattended runs. [`lockdown`] replaces this temporary
+/// rule after the host connects.
+pub async fn pre_authorize() -> Result<()> {
+    let exe = std::env::current_exe().context("resolve guest executable path")?;
+    let program = exe.to_string_lossy();
+
+    run_netsh(&[
+        "advfirewall",
+        "firewall",
+        "add",
+        "rule",
+        "name=WxcAgentPreAuth",
+        "dir=in",
+        "action=allow",
+        "protocol=TCP",
+        "profile=any",
+        "enable=yes",
+        &format!("program={}", program),
+    ])
+    .await
+    .context("add pre-authorization inbound allow rule")?;
+
+    Ok(())
+}
+
+/// Restrict traffic to the established host connection and block everything
+/// else. The outbound rule uses the listener's source port so scripts cannot
+/// open new connections to arbitrary host services.
 pub async fn lockdown(host_ip: IpAddr, listen_port: u16) -> Result<()> {
     let host = host_ip.to_string();
     let port = listen_port.to_string();
 
-    // Delete all existing firewall rules.
     run_netsh(&["advfirewall", "firewall", "delete", "rule", "name=all"])
         .await
         .context("delete existing rules")?;
 
-    // Allow inbound from host to our listen port.
     run_netsh(&[
         "advfirewall",
         "firewall",
@@ -40,7 +60,6 @@ pub async fn lockdown(host_ip: IpAddr, listen_port: u16) -> Result<()> {
     .await
     .context("add inbound allow rule")?;
 
-    // Allow outbound to host.
     run_netsh(&[
         "advfirewall",
         "firewall",
@@ -50,12 +69,12 @@ pub async fn lockdown(host_ip: IpAddr, listen_port: u16) -> Result<()> {
         "dir=out",
         "action=allow",
         "protocol=TCP",
+        &format!("localport={}", port),
         &format!("remoteip={}", host),
     ])
     .await
     .context("add outbound allow rule")?;
 
-    // Block everything else.
     run_netsh(&[
         "advfirewall",
         "set",
diff --git a/src/backends/windows_sandbox/guest/src/job.rs b/src/backends/windows_sandbox/guest/src/job.rs
new file mode 100644
index 000000000..2b8663f3a
--- /dev/null
+++ b/src/backends/windows_sandbox/guest/src/job.rs
@@ -0,0 +1,130 @@
+//! Job Object helper for terminating a script's process tree.
+//!
+//! Job membership survives the immediate child's exit, avoiding the PID-reuse
+//! and broken-tree limitations of a later `taskkill /T`. Assignment remains
+//! best-effort, so the caller also bounds stdio drain time.
+
+use anyhow::{Context, Result};
+use windows::Win32::Foundation::{CloseHandle, HANDLE};
+use windows::Win32::System::JobObjects::{
+    AssignProcessToJobObject, CreateJobObjectW, JobObjectExtendedLimitInformation,
+    SetInformationJobObject, TerminateJobObject, JOBOBJECT_EXTENDED_LIMIT_INFORMATION,
+    JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE,
+};
+use windows::Win32::System::Threading::{OpenProcess, PROCESS_SET_QUOTA, PROCESS_TERMINATE};
+
+/// An owned Job Object configured to kill all member processes when its last
+/// handle closes.
+pub struct Job {
+    handle: HANDLE,
+}
+
+// The job handle is only ever used to call thread-safe Win32 APIs.
+unsafe impl Send for Job {}
+unsafe impl Sync for Job {}
+
+impl Job {
+    /// Create a Job Object whose members are killed when the job handle closes.
+    pub fn new() -> Result<Self> {
+        // SAFETY: passing null security attributes / name creates an anonymous
+        // job; the returned handle is validated below.
+        let handle = unsafe { CreateJobObjectW(None, None) }.context("CreateJobObjectW")?;
+
+        let mut info = JOBOBJECT_EXTENDED_LIMIT_INFORMATION::default();
+        info.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
+        // SAFETY: `info` is a correctly-sized, fully-initialized structure for
+        // the JobObjectExtendedLimitInformation class.
+        let set = unsafe {
+            SetInformationJobObject(
+                handle,
+                JobObjectExtendedLimitInformation,
+                &info as *const _ as *const core::ffi::c_void,
+                core::mem::size_of::<JOBOBJECT_EXTENDED_LIMIT_INFORMATION>() as u32,
+            )
+        };
+        if let Err(err) = set {
+            // SAFETY: handle came from CreateJobObjectW above.
+            unsafe {
+                let _ = CloseHandle(handle);
+            }
+            return Err(err).context("SetInformationJobObject(KILL_ON_JOB_CLOSE)");
+        }
+
+        Ok(Self { handle })
+    }
+
+    /// Assign a process to this job.
+    pub fn assign(&self, pid: u32) -> Result<()> {
+        // SAFETY: pid is a live child's PID; we request only the rights needed
+        // to assign it to a job, and close the process handle immediately.
+        let proc = unsafe { OpenProcess(PROCESS_SET_QUOTA | PROCESS_TERMINATE, false, pid) }
+            .context("OpenProcess for job assignment")?;
+        let result = unsafe { AssignProcessToJobObject(self.handle, proc) };
+        // SAFETY: proc came from OpenProcess above.
+        unsafe {
+            let _ = CloseHandle(proc);
+        }
+        result.context("AssignProcessToJobObject")
+    }
+
+    /// Terminate every process currently in the job.
+    pub fn terminate(&self) {
+        // SAFETY: self.handle is a valid job handle for the job's lifetime.
+        if let Err(err) = unsafe { TerminateJobObject(self.handle, 1) } {
+            eprintln!("[guest] TerminateJobObject failed: {err}");
+        }
+    }
+}
+
+impl Drop for Job {
+    fn drop(&mut self) {
+        // SAFETY: self.handle is a valid job handle created in `new`.
+        unsafe {
+            let _ = CloseHandle(self.handle);
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::process::Command;
+    use std::time::{Duration, Instant};
+
+    #[test]
+    fn job_terminates_assigned_process_tree() {
+        let job = Job::new().expect("create job");
+
+        let mut child = Command::new("cmd.exe")
+            .args(["/C", "ping -n 999 127.0.0.1 >nul"])
+            .spawn()
+            .expect("spawn child");
+        job.assign(child.id()).expect("assign child to job");
+
+        job.terminate();
+
+        let deadline = Instant::now() + Duration::from_secs(10);
+        loop {
+            match child.try_wait().expect("try_wait") {
+                Some(_status) => break,
+                None if Instant::now() >= deadline => {
+                    let _ = child.kill();
+                    panic!("job-terminated child did not exit");
+                }
+                None => std::thread::sleep(Duration::from_millis(50)),
+            }
+        }
+    }
+
+    #[test]
+    fn assign_dead_pid_errors_not_panics() {
+        let job = Job::new().expect("create job");
+        let mut child = Command::new("cmd.exe")
+            .args(["/C", "exit 0"])
+            .spawn()
+            .expect("spawn child");
+        let pid = child.id();
+        child.wait().expect("wait");
+        let _ = job.assign(pid);
+    }
+}
diff --git a/src/backends/windows_sandbox/guest/src/listener.rs b/src/backends/windows_sandbox/guest/src/listener.rs
index 34fc69f1f..841624b46 100644
--- a/src/backends/windows_sandbox/guest/src/listener.rs
+++ b/src/backends/windows_sandbox/guest/src/listener.rs
@@ -6,21 +6,20 @@ use std::path::Path;
 use anyhow::{Context, Result};
 use tokio::fs;
 use tokio::net::{TcpListener, TcpStream};
+use tokio::sync::mpsc;
 
-/// Bind a TCP listener on all interfaces (port 0 = OS-assigned) and write a
-/// rendezvous file so the host daemon can discover us.
+use windows_sandbox_common::auth::{self, ChannelRole, Nonce};
+
+/// Bind a TCP listener and publish its address for the host.
 pub async fn bind_and_advertise(rendezvous_dir: &str) -> Result<(TcpListener, SocketAddr)> {
     let listener = TcpListener::bind("0.0.0.0:0")
         .await
         .context("bind TCP listener")?;
     let local_addr = listener.local_addr()?;
 
-    // Discover our IP on the Hyper-V Default Switch.  We take the first
-    // non-loopback IPv4 address we can find.
     let guest_ip = find_guest_ip().context("could not determine guest IP")?;
     let advertised_addr = SocketAddr::new(guest_ip, local_addr.port());
 
-    // Write rendezvous file: "<ip>:<port>"
     let rendezvous_path = Path::new(rendezvous_dir).join("rendezvous.txt");
     let content = format!("{}", advertised_addr);
     fs::write(&rendezvous_path, content.as_bytes())
@@ -30,36 +29,154 @@ pub async fn bind_and_advertise(rendezvous_dir: &str) -> Result<(TcpListener, So
     Ok((listener, advertised_addr))
 }
 
-/// Accept exactly four TCP connections from the host in order:
-/// control, stdin, stdout, stderr.
+/// Accept the four boot channels, paired by declared [`ChannelRole`].
 pub async fn accept_connections(
     listener: &TcpListener,
+    expected_nonce: &Nonce,
 ) -> Result<(TcpStream, TcpStream, TcpStream, TcpStream)> {
-    let (control, _) = listener.accept().await.context("accept control")?;
-    let (stdin_stream, stdout_stream, stderr_stream) = accept_data_connections(listener).await?;
-    Ok((control, stdin_stream, stdout_stream, stderr_stream))
+    let (control, stdin_stream, stdout_stream, stderr_stream) =
+        accept_authed_roles(listener, expected_nonce, true).await?;
+    Ok((
+        control.expect("control filled before accept_authed_roles returned"),
+        stdin_stream.expect("stdin filled"),
+        stdout_stream.expect("stdout filled"),
+        stderr_stream.expect("stderr filled"),
+    ))
 }
 
-/// Accept exactly three data TCP connections from the host in order:
-/// stdin, stdout, stderr.
-///
-/// Used both on initial startup (called by [`accept_connections`]) and
-/// after each execution to re-establish data streams for the next EXEC.
+/// Accept the three post-exec data channels.
 pub async fn accept_data_connections(
     listener: &TcpListener,
+    expected_nonce: &Nonce,
 ) -> Result<(TcpStream, TcpStream, TcpStream)> {
-    let (stdin_stream, _) = listener.accept().await.context("accept stdin")?;
-    let (stdout_stream, _) = listener.accept().await.context("accept stdout")?;
-    let (stderr_stream, _) = listener.accept().await.context("accept stderr")?;
-    Ok((stdin_stream, stdout_stream, stderr_stream))
+    let (_control, stdin_stream, stdout_stream, stderr_stream) =
+        accept_authed_roles(listener, expected_nonce, false).await?;
+    Ok((
+        stdin_stream.expect("stdin filled before accept_authed_roles returned"),
+        stdout_stream.expect("stdout filled"),
+        stderr_stream.expect("stderr filled"),
+    ))
+}
+
+/// Place `stream` in the slot for `role`; a later valid declaration wins.
+fn assign_role(
+    stream: TcpStream,
+    role: ChannelRole,
+    control: &mut Option<TcpStream>,
+    stdin_stream: &mut Option<TcpStream>,
+    stdout_stream: &mut Option<TcpStream>,
+    stderr_stream: &mut Option<TcpStream>,
+) {
+    let slot = match role {
+        ChannelRole::Control => control,
+        ChannelRole::Stdin => stdin_stream,
+        ChannelRole::Stdout => stdout_stream,
+        ChannelRole::Stderr => stderr_stream,
+    };
+    if let Some(old) = slot.replace(stream) {
+        eprintln!(
+            "[guest][auth] {} role re-declared; displacing the earlier socket (last-writer-wins)",
+            role.label()
+        );
+        drop(old);
+    }
+}
+
+const HANDSHAKE_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(1);
+
+/// Accept and authenticate sockets until every required role is filled.
+async fn accept_authed_roles(
+    listener: &TcpListener,
+    expected_nonce: &Nonce,
+    want_control: bool,
+) -> Result<(
+    Option<TcpStream>,
+    Option<TcpStream>,
+    Option<TcpStream>,
+    Option<TcpStream>,
+)> {
+    let (tx, mut rx) = mpsc::channel::<(TcpStream, ChannelRole)>(16);
+
+    let mut control: Option<TcpStream> = None;
+    let mut stdin_stream: Option<TcpStream> = None;
+    let mut stdout_stream: Option<TcpStream> = None;
+    let mut stderr_stream: Option<TcpStream> = None;
+
+    let filled = |control: &Option<TcpStream>,
+                  stdin_stream: &Option<TcpStream>,
+                  stdout_stream: &Option<TcpStream>,
+                  stderr_stream: &Option<TcpStream>| {
+        (!want_control || control.is_some())
+            && stdin_stream.is_some()
+            && stdout_stream.is_some()
+            && stderr_stream.is_some()
+    };
+
+    while !filled(&control, &stdin_stream, &stdout_stream, &stderr_stream) {
+        tokio::select! {
+            accepted = listener.accept() => {
+                let (mut stream, peer) = accepted.context("accept")?;
+                let nonce = expected_nonce.clone();
+                let tx = tx.clone();
+                // Off-load the handshake so a stalled peer cannot block accepts.
+                tokio::spawn(async move {
+                    match tokio::time::timeout(
+                        HANDSHAKE_TIMEOUT,
+                        auth::verify_nonce(&mut stream, &nonce),
+                    )
+                    .await
+                    {
+                        Ok(Ok(role)) => {
+                            // A send failure means the collector already returned.
+                            let _ = tx.send((stream, role)).await;
+                        }
+                        Ok(Err(e)) => {
+                            eprintln!(
+                                "[guest][auth] rejecting connection from {peer}: {e} (likely a \
+                                 cross-user accept-race or protocol mismatch; dropping)"
+                            );
+                            drop(stream);
+                        }
+                        Err(_) => {
+                            eprintln!(
+                                "[guest][auth] handshake from {peer} timed out after \
+                                 {HANDSHAKE_TIMEOUT:?} (no nonce + role bytes received); dropping \
+                                 socket (stalled-handshake guard)"
+                            );
+                            drop(stream);
+                        }
+                    }
+                });
+            }
+            // This function retains a sender, so the receive channel cannot close here.
+            Some((stream, role)) = rx.recv() => {
+                if !want_control && matches!(role, ChannelRole::Control) {
+                    eprintln!(
+                        "[guest][auth] rejecting unexpected Control role on data reconnect; \
+                         dropping"
+                    );
+                    drop(stream);
+                    continue;
+                }
+                assign_role(
+                    stream,
+                    role,
+                    &mut control,
+                    &mut stdin_stream,
+                    &mut stdout_stream,
+                    &mut stderr_stream,
+                );
+            }
+        }
+    }
+    Ok((control, stdin_stream, stdout_stream, stderr_stream))
 }
 
 /// Find the first non-loopback IPv4 address (the Hyper-V Default Switch NIC).
 fn find_guest_ip() -> Result<std::net::IpAddr> {
     use std::net::IpAddr;
 
-    // Attempt a UDP "connect" to a routable address to determine the
-    // local source address — works without actually sending traffic.
+    // A UDP connect selects a local address without sending traffic.
     let socket = std::net::UdpSocket::bind("0.0.0.0:0")?;
     socket.connect("1.1.1.1:80")?;
     let local_addr = socket.local_addr()?;
@@ -74,14 +191,274 @@ fn find_guest_ip() -> Result<std::net::IpAddr> {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use windows_sandbox_common::auth::{
+        generate_nonce, write_nonce, ChannelRole, Nonce, NONCE_LEN_IN_BYTES,
+    };
 
     #[test]
     fn find_guest_ip_returns_non_loopback() {
-        // This test validates the helper works on any machine with a network
-        // adapter.  It will fail on a completely disconnected host, which is
-        // acceptable.
         if let Ok(ip) = find_guest_ip() {
             assert!(!ip.is_loopback());
         }
     }
+
+    // Exercise nonce authentication and role-based pairing over loopback.
+    async fn bind_loopback() -> (TcpListener, std::net::SocketAddr) {
+        let l = TcpListener::bind("127.0.0.1:0").await.expect("bind");
+        let a = l.local_addr().expect("local_addr");
+        (l, a)
+    }
+
+    /// Open a TCP connection to `addr`, write the nonce + role tag using
+    /// the host-side helper, and hand the stream back to the caller.
+    async fn host_connect(
+        addr: std::net::SocketAddr,
+        nonce: &Nonce,
+        role: ChannelRole,
+    ) -> TcpStream {
+        let mut s = TcpStream::connect(addr).await.expect("connect");
+        write_nonce(&mut s, nonce, role).await.expect("write nonce");
+        s
+    }
+
+    #[tokio::test]
+    async fn accept_connections_pairs_by_declared_role_not_accept_order() {
+        // Connect in a non-canonical order (stderr -> stdout -> control ->
+        // stdin) and assert each guest-side slot receives the correctly-paired
+        // socket regardless of arrival order. FIFO-by-accept-order pairing would
+        // misroute, e.g. surfacing stderr bytes on the control slot.
+        let (listener, addr) = bind_loopback().await;
+        let nonce = generate_nonce().expect("generate nonce");
+        let expected = nonce.clone();
+        let guest = tokio::spawn(async move { accept_connections(&listener, &expected).await });
+
+        // Connect in reversed-from-canonical order:
+        let mut stderr_host = host_connect(addr, &nonce, ChannelRole::Stderr).await;
+        let mut stdout_host = host_connect(addr, &nonce, ChannelRole::Stdout).await;
+        let mut control_host = host_connect(addr, &nonce, ChannelRole::Control).await;
+        let mut stdin_host = host_connect(addr, &nonce, ChannelRole::Stdin).await;
+
+        let (mut control, mut stdin, mut stdout, mut stderr) =
+            guest.await.expect("guest task join").expect("accept ok");
+
+        // Tag each host side with a single byte and assert the GUEST side
+        // of the slot reads exactly that byte. If the slots were misordered
+        // we would read the wrong byte (or hang).
+        use tokio::io::{AsyncReadExt, AsyncWriteExt};
+        for (host, sentinel, slot) in [
+            (&mut control_host, b'C', &mut control),
+            (&mut stdin_host, b'I', &mut stdin),
+            (&mut stdout_host, b'O', &mut stdout),
+            (&mut stderr_host, b'E', &mut stderr),
+        ] {
+            host.write_all(&[sentinel]).await.expect("host write");
+            host.shutdown().await.ok();
+            let mut byte = [0u8; 1];
+            let n = slot.read(&mut byte).await.expect("read slot");
+            assert_eq!(n, 1);
+            assert_eq!(
+                byte[0], sentinel,
+                "slot for {} sentinel mismatch (role-tag pairing regression)",
+                sentinel as char
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn accept_drops_wrong_nonce_and_keeps_waiting_for_legitimate_peer() {
+        // A wrong-nonce peer must be dropped silently before any protocol
+        // bytes are exchanged, and the accept loop must continue serving the
+        // legitimate peer. Exercises the guest's drop-and-retry loop against a
+        // real socket.
+        let (listener, addr) = bind_loopback().await;
+        let expected = generate_nonce().expect("generate nonce");
+        let cloned_expected = expected.clone();
+        let guest =
+            tokio::spawn(async move { accept_connections(&listener, &cloned_expected).await });
+
+        // Hostile connect: wrong nonce. The guest drops the socket and
+        // returns to accept(); the host sees EOF on the read attempt.
+        let bad_nonce = generate_nonce().expect("generate nonce");
+        let mut hostile = TcpStream::connect(addr).await.expect("hostile connect");
+        write_nonce(&mut hostile, &bad_nonce, ChannelRole::Control)
+            .await
+            .expect("hostile write");
+        use tokio::io::AsyncReadExt;
+        let mut buf = [0u8; 1];
+        // We may or may not see EOF before the legitimate connects below
+        // depending on scheduling -- the important property is that
+        // accept_connections still completes once all four legitimate
+        // sockets arrive.
+        let _ = tokio::time::timeout(
+            std::time::Duration::from_millis(100),
+            hostile.read(&mut buf),
+        )
+        .await;
+
+        let _legit_c = host_connect(addr, &expected, ChannelRole::Control).await;
+        let _legit_i = host_connect(addr, &expected, ChannelRole::Stdin).await;
+        let _legit_o = host_connect(addr, &expected, ChannelRole::Stdout).await;
+        let _legit_e = host_connect(addr, &expected, ChannelRole::Stderr).await;
+
+        let result = tokio::time::timeout(std::time::Duration::from_secs(5), guest)
+            .await
+            .expect("accept_connections completes within budget after wrong-nonce drop")
+            .expect("guest task join")
+            .expect("accept ok");
+        let (_c, _i, _o, _e) = result;
+        drop(hostile);
+    }
+
+    #[tokio::test]
+    async fn accept_drops_duplicate_role_no_cross_talk() {
+        // Handshake completion order is nondeterministic; exactly one peer must
+        // own the role without displacement or cross-talk.
+        let (listener, addr) = bind_loopback().await;
+        let nonce = generate_nonce().expect("generate nonce");
+        let expected = nonce.clone();
+        let guest = tokio::spawn(async move { accept_connections(&listener, &expected).await });
+
+        let mut control_a = host_connect(addr, &nonce, ChannelRole::Control).await;
+        let mut control_b = host_connect(addr, &nonce, ChannelRole::Control).await;
+
+        // The rest of the legitimate channels.
+        let _legit_i = host_connect(addr, &nonce, ChannelRole::Stdin).await;
+        let _legit_o = host_connect(addr, &nonce, ChannelRole::Stdout).await;
+        let _legit_e = host_connect(addr, &nonce, ChannelRole::Stderr).await;
+
+        let result = tokio::time::timeout(std::time::Duration::from_secs(5), guest)
+            .await
+            .expect("accept completes")
+            .expect("guest task join")
+            .expect("accept ok");
+        let (mut control, _stdin, _stdout, _stderr) = result;
+
+        // Write a DISTINCT sentinel on each Control peer. The guest paired the
+        // slot with exactly one of them; that one feeds the slot, the other is
+        // a dropped socket.
+        use tokio::io::{AsyncReadExt, AsyncWriteExt};
+        let _ = control_a.write_all(b"A").await;
+        let _ = control_a.shutdown().await;
+        let _ = control_b.write_all(b"B").await;
+        let _ = control_b.shutdown().await;
+
+        let mut byte = [0u8; 1];
+        let n = control.read(&mut byte).await.expect("guest control reads");
+        assert_eq!(
+            n, 1,
+            "kept control slot must deliver exactly the winner's byte"
+        );
+        assert!(
+            byte[0] == b'A' || byte[0] == b'B',
+            "kept control delivered an unexpected sentinel {:?}",
+            byte[0]
+        );
+
+        // No SECOND byte may arrive on the slot: the dropped duplicate must not
+        // also be wired to it (that would be displacement / cross-talk).
+        let mut extra = [0u8; 1];
+        let extra_read = tokio::time::timeout(
+            std::time::Duration::from_millis(200),
+            control.read(&mut extra),
+        )
+        .await;
+        match extra_read {
+            // EOF on the held socket is fine (no displacement).
+            Ok(Ok(0)) => {}
+            // Any byte read here means the dropped peer fed our slot -- regression.
+            Ok(Ok(n)) => panic!(
+                "dropped duplicate-role peer wrote {n} byte(s) onto the kept control slot ({:?})",
+                &extra[..n]
+            ),
+            // Timeout = nothing else arrived, also fine.
+            Err(_) => {}
+            // Read error on the held socket is fine.
+            Ok(Err(_)) => {}
+        }
+    }
+
+    #[tokio::test]
+    async fn accept_data_connections_pairs_three_by_role() {
+        // Regression coverage for the post-StreamsReady data-stream
+        // reconnect path. Same property as accept_connections but only three roles
+        // (stdin, stdout, stderr) and a Control declaration must be
+        // dropped.
+        let (listener, addr) = bind_loopback().await;
+        let nonce = generate_nonce().expect("generate nonce");
+        let expected = nonce.clone();
+        let guest =
+            tokio::spawn(async move { accept_data_connections(&listener, &expected).await });
+
+        // A peer declaring Control on the data path must be dropped (only
+        // stdin/stdout/stderr are valid on reconnect).
+        let mut bogus = host_connect(addr, &nonce, ChannelRole::Control).await;
+        use tokio::io::{AsyncReadExt, AsyncWriteExt};
+        let _ = bogus.shutdown().await;
+
+        // Now connect the three legitimate data channels in a non-canonical
+        // order.
+        let mut stderr_host = host_connect(addr, &nonce, ChannelRole::Stderr).await;
+        let mut stdin_host = host_connect(addr, &nonce, ChannelRole::Stdin).await;
+        let mut stdout_host = host_connect(addr, &nonce, ChannelRole::Stdout).await;
+
+        let (mut stdin, mut stdout, mut stderr) =
+            tokio::time::timeout(std::time::Duration::from_secs(5), guest)
+                .await
+                .expect("accept_data completes")
+                .expect("join")
+                .expect("accept ok");
+
+        for (host, sentinel, slot) in [
+            (&mut stdin_host, b'I', &mut stdin),
+            (&mut stdout_host, b'O', &mut stdout),
+            (&mut stderr_host, b'E', &mut stderr),
+        ] {
+            host.write_all(&[sentinel]).await.expect("host write");
+            host.shutdown().await.ok();
+            let mut byte = [0u8; 1];
+            let n = slot.read(&mut byte).await.expect("slot read");
+            assert_eq!((n, byte[0]), (1, sentinel));
+        }
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn accept_drops_stalled_handshake_within_handshake_timeout() {
+        // Regression: a peer that connects
+        // and never writes must NOT wedge the accept loop. The guest
+        // wraps verify_nonce in `tokio::time::timeout(HANDSHAKE_TIMEOUT,
+        // ...)`; this test asserts the stalled connection is dropped
+        // and the legitimate four-way handshake then completes.
+        let (listener, addr) = bind_loopback().await;
+        let nonce = generate_nonce().expect("generate nonce");
+        let expected = nonce.clone();
+        let guest = tokio::spawn(async move { accept_connections(&listener, &expected).await });
+
+        // Stalled peer: connect, write nothing.
+        let _stalled = TcpStream::connect(addr).await.expect("stalled connect");
+
+        // Advance time past HANDSHAKE_TIMEOUT so the guest drops the stalled
+        // socket and returns to accept(). Yield repeatedly to give the
+        // guest's spawned task a chance to observe the timeout.
+        tokio::time::advance(HANDSHAKE_TIMEOUT + std::time::Duration::from_millis(100)).await;
+        for _ in 0..50 {
+            tokio::task::yield_now().await;
+        }
+
+        // Now do a legitimate full handshake. Under paused time the
+        // network ops here resolve via the runtime's IO driver, which
+        // tokio::time::pause leaves intact.
+        let _legit_c = host_connect(addr, &nonce, ChannelRole::Control).await;
+        let _legit_i = host_connect(addr, &nonce, ChannelRole::Stdin).await;
+        let _legit_o = host_connect(addr, &nonce, ChannelRole::Stdout).await;
+        let _legit_e = host_connect(addr, &nonce, ChannelRole::Stderr).await;
+
+        // Bounded timeout in case the loop did NOT recover (regression).
+        let result = tokio::time::timeout(std::time::Duration::from_secs(5), guest).await;
+        assert!(
+            result.is_ok(),
+            "accept_connections did not complete after handshake-timeout recovery; \
+             stalled peer wedged the loop (H11 regression)"
+        );
+        let _ = NONCE_LEN_IN_BYTES;
+    }
 }
diff --git a/src/backends/windows_sandbox/guest/src/main.rs b/src/backends/windows_sandbox/guest/src/main.rs
index 3d362126b..155369f09 100644
--- a/src/backends/windows_sandbox/guest/src/main.rs
+++ b/src/backends/windows_sandbox/guest/src/main.rs
@@ -1,14 +1,8 @@
-//! Windows Sandbox Guest Process
-//!
-//! Runs inside Windows Sandbox as the LogonCommand. Startup sequence:
-//!   1. Listen on a TCP port
-//!   2. Write rendezvous file (IP + port) to the mapped folder
-//!   3. Accept 4 connections from host (control, stdin, stdout, stderr)
-//!   4. Lock down guest firewall (allow only host IP)
-//!   5. Enter command loop: receive EXEC commands, spawn scripts, bridge stdio
+//! Windows Sandbox guest agent.
 
 mod executor;
 mod firewall;
+mod job;
 mod listener;
 
 use anyhow::{Context, Result};
@@ -20,33 +14,49 @@ const RENDEZVOUS_DIR: &str = r"C:\sandbox-rendezvous";
 async fn main() -> Result<()> {
     eprintln!("[guest] starting");
 
-    // Step 1-2: bind TCP listener, write rendezvous file.
+    // Without the nonce, host connections cannot be authenticated.
+    let nonce = windows_sandbox_common::auth::read_and_consume_nonce_file(
+        std::path::Path::new(RENDEZVOUS_DIR),
+        windows_sandbox_common::auth::NONCE_READ_TIMEOUT,
+    )
+    .await
+    .context("read per-launch authentication nonce")?;
+    eprintln!(
+        "[guest] authentication nonce loaded ({} bytes)",
+        windows_sandbox_common::auth::NONCE_LEN_IN_BYTES
+    );
+
+    // Pre-authorise before binding to avoid an interactive firewall prompt.
+    if let Err(err) = firewall::pre_authorize().await {
+        eprintln!("[guest] firewall pre-authorization failed (continuing): {err:#}");
+    } else {
+        eprintln!("[guest] firewall pre-authorized");
+    }
+
     let (tcp_listener, local_addr) = listener::bind_and_advertise(RENDEZVOUS_DIR)
         .await
         .context("failed to start TCP listener")?;
     eprintln!("[guest] listening on {}", local_addr);
 
-    // Step 3: accept 4 connections from the host daemon.
     let (control, stdin_stream, stdout_stream, stderr_stream) =
-        listener::accept_connections(&tcp_listener)
+        listener::accept_connections(&tcp_listener, &nonce)
             .await
             .context("failed to accept host connections")?;
     let host_ip = control.peer_addr()?.ip();
     eprintln!("[guest] host connected from {}", host_ip);
 
-    // Step 4: lock down firewall — only allow the host IP.
     firewall::lockdown(host_ip, local_addr.port())
         .await
         .context("firewall lockdown failed")?;
     eprintln!("[guest] firewall locked down");
 
-    // Step 5: enter command loop.
     executor::run_command_loop(
         control,
         stdin_stream,
         stdout_stream,
         stderr_stream,
         &tcp_listener,
+        &nonce,
     )
     .await
 }
diff --git a/src/backends/windows_sandbox/lifecycle/Cargo.toml b/src/backends/windows_sandbox/lifecycle/Cargo.toml
new file mode 100644
index 000000000..48cfcc67f
--- /dev/null
+++ b/src/backends/windows_sandbox/lifecycle/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "windows_sandbox_lifecycle"
+version.workspace = true
+edition.workspace = true
+
+[dependencies]
+windows_sandbox_common = { workspace = true }
+wxc_common = { workspace = true }
+tokio.workspace = true
+anyhow.workspace = true
+uuid.workspace = true
+serde = { workspace = true }
+serde_json = { workspace = true }
+
+[target.'cfg(windows)'.dependencies]
+windows = { workspace = true }
+
+[dev-dependencies]
+tempfile.workspace = true
diff --git a/src/backends/windows_sandbox/lifecycle/src/bridge.rs b/src/backends/windows_sandbox/lifecycle/src/bridge.rs
new file mode 100644
index 000000000..2d1c78a29
--- /dev/null
+++ b/src/backends/windows_sandbox/lifecycle/src/bridge.rs
@@ -0,0 +1,1070 @@
+//! TCP bridge to the guest agent.
+//!
+//! Establishes four outbound TCP connections to the guest agent and provides
+//! the bridge for relaying control/stdin/stdout/stderr.
+
+use std::net::SocketAddr;
+use std::time::Duration;
+
+use anyhow::{Context, Result};
+use tokio::io::{AsyncReadExt, AsyncWrite, AsyncWriteExt};
+use tokio::net::TcpStream;
+
+use windows_sandbox_common::auth::{self, ChannelRole, Nonce};
+use windows_sandbox_common::sandbox_protocol::{
+    decode_message, encode_message, validate_preamble, ControlMessage, DecodeResult, ExecRequest,
+    PREAMBLE_LEN,
+};
+
+use crate::ipc_exec::{self, ExecStart, FrameKind};
+
+const STREAMS_READY_TIMEOUT_SECS: Duration = Duration::from_secs(60);
+
+const RECONNECT_TIMEOUT_SECS: Duration = Duration::from_secs(30);
+
+const IPC_WRITE_TIMEOUT_SECS: Duration = Duration::from_secs(30);
+
+const POST_EXIT_DRAIN_SECS: Duration = Duration::from_secs(15);
+
+const PREAMBLE_HANDSHAKE_TIMEOUT_SECS: Duration = Duration::from_secs(10);
+
+/// Four TCP connections to the guest agent.
+pub struct GuestConnection {
+    pub control: TcpStream,
+    pub stdin_stream: TcpStream,
+    pub stdout_stream: TcpStream,
+    pub stderr_stream: TcpStream,
+}
+
+/// Result of executing a script on the guest agent.
+pub struct ExecResult {
+    /// Process exit code (negative values indicate error/timeout).
+    pub exit_code: i32,
+    /// Optional error message from the agent.
+    pub error_message: String,
+    /// Captured stdout bytes from the child process.
+    pub stdout: Vec<u8>,
+    /// Captured stderr bytes from the child process.
+    pub stderr: Vec<u8>,
+    /// Control bytes read beyond the exit frame.
+    pub control_residual: Vec<u8>,
+}
+
+/// Connect to the guest agent and wait for `Ready`.
+///
+/// Each connection begins with the launch nonce and a [`ChannelRole`] byte.
+pub async fn connect_to_guest(
+    addr: SocketAddr,
+    timeout: std::time::Duration,
+    nonce: &Nonce,
+) -> Result<GuestConnection> {
+    let connect = |role: ChannelRole| async move {
+        let label = role.label();
+        let mut stream = tokio::time::timeout(timeout, TcpStream::connect(addr))
+            .await
+            .with_context(|| format!("timeout connecting {} to {}", label, addr))?
+            .with_context(|| format!("connect {} to {}", label, addr))?;
+        tokio::time::timeout(timeout, auth::write_nonce(&mut stream, nonce, role))
+            .await
+            .with_context(|| format!("timeout writing nonce on {} to {}", label, addr))?
+            .with_context(|| format!("write nonce on {} to {}", label, addr))?;
+        Ok::<TcpStream, anyhow::Error>(stream)
+    };
+
+    let control = connect(ChannelRole::Control).await?;
+    let stdin_stream = connect(ChannelRole::Stdin).await?;
+    let stdout_stream = connect(ChannelRole::Stdout).await?;
+    let stderr_stream = connect(ChannelRole::Stderr).await?;
+
+    eprintln!("[daemon] 4 TCP connections established to {}", addr);
+
+    let mut conn = GuestConnection {
+        control,
+        stdin_stream,
+        stdout_stream,
+        stderr_stream,
+    };
+    let handshake_timeout = timeout.min(PREAMBLE_HANDSHAKE_TIMEOUT_SECS);
+    read_and_validate_preamble(&mut conn.control, handshake_timeout).await?;
+    wait_for_ready(&mut conn.control, timeout).await?;
+
+    Ok(conn)
+}
+
+/// Read the fixed 8-byte control preamble and validate magic + version.
+async fn read_and_validate_preamble(
+    control: &mut TcpStream,
+    timeout: std::time::Duration,
+) -> Result<()> {
+    let mut preamble = [0u8; PREAMBLE_LEN];
+    tokio::time::timeout(timeout, control.read_exact(&mut preamble))
+        .await
+        .context("timeout reading guest preamble")?
+        .context("read guest preamble")?;
+    let version = validate_preamble(&preamble).map_err(|e| {
+        anyhow::anyhow!(
+            "guest protocol handshake failed: {} (refusing connection)",
+            e
+        )
+    })?;
+    eprintln!("[daemon] guest protocol handshake ok (version {})", version);
+    Ok(())
+}
+
+/// Read from the control channel until a `Ready` message arrives.
+async fn wait_for_ready(control: &mut TcpStream, timeout: std::time::Duration) -> Result<()> {
+    let mut buf = Vec::with_capacity(256);
+    let mut tmp = [0u8; 256];
+    let deadline = tokio::time::Instant::now() + timeout;
+
+    loop {
+        let remaining = deadline
+            .checked_duration_since(tokio::time::Instant::now())
+            .unwrap_or(Duration::ZERO);
+        let n = tokio::time::timeout(remaining, control.read(&mut tmp))
+            .await
+            .context("timeout waiting for Ready")?
+            .context("read control for Ready")?;
+        if n == 0 {
+            anyhow::bail!("control connection closed before Ready");
+        }
+        buf.extend_from_slice(&tmp[..n]);
+
+        match decode_message(&buf).context("decode Ready")? {
+            DecodeResult::Message {
+                message: ControlMessage::Ready,
+                consumed,
+            } => {
+                buf.drain(..consumed);
+                eprintln!("[daemon] received Ready from guest agent");
+                return Ok(());
+            }
+            DecodeResult::Message { message, .. } => {
+                anyhow::bail!("expected Ready, got {:?}", message);
+            }
+            DecodeResult::Incomplete => {
+                continue;
+            }
+        }
+    }
+}
+
+/// Send an EXEC request to the guest and relay stdin/stdout/stderr.
+pub async fn execute_on_guest(
+    conn: &mut GuestConnection,
+    exec_id: &str,
+    script_code: &str,
+    working_directory: &str,
+    timeout_ms: u32,
+    host_stdin: &[u8],
+) -> Result<ExecResult> {
+    let exec_msg = ControlMessage::Exec(ExecRequest {
+        exec_id: exec_id.to_string(),
+        script_code: script_code.to_string(),
+        working_directory: working_directory.to_string(),
+        timeout_ms,
+    });
+    let frame = encode_message(&exec_msg).context("encode EXEC")?;
+    conn.control.write_all(&frame).await.context("send EXEC")?;
+
+    // Pump stdin concurrently with output to avoid filling opposing TCP windows.
+    // BrokenPipe is non-fatal because commands may exit without consuming stdin.
+    let stdin_task = {
+        let stream = &mut conn.stdin_stream;
+        async move {
+            if !host_stdin.is_empty() {
+                if let Err(e) = stream.write_all(host_stdin).await {
+                    return Some(anyhow::Error::new(e).context("write stdin to guest"));
+                }
+            }
+            // Shut down the write half to signal EOF.
+            stream
+                .shutdown()
+                .await
+                .err()
+                .map(|e| anyhow::Error::new(e).context("shutdown stdin"))
+        }
+    };
+
+    // Preserve partial output on failure. A reset before any bytes is an empty
+    // stream; a reset after data is a transport error.
+    let stdout_task = {
+        let stream = &mut conn.stdout_stream;
+        async move {
+            let mut buf = Vec::new();
+            let mut tmp = [0u8; 8192];
+            let mut seen: u64 = 0;
+            loop {
+                let r = stream.read(&mut tmp).await;
+                match classify_data_read(r, seen, "stdout") {
+                    Ok(Some(n)) => {
+                        buf.extend_from_slice(&tmp[..n]);
+                        seen += n as u64;
+                    }
+                    Ok(None) => break,
+                    Err(e) => return (buf, Some(e)),
+                }
+            }
+            (buf, None)
+        }
+    };
+    let stderr_task = {
+        let stream = &mut conn.stderr_stream;
+        async move {
+            let mut buf = Vec::new();
+            let mut tmp = [0u8; 8192];
+            let mut seen: u64 = 0;
+            loop {
+                let r = stream.read(&mut tmp).await;
+                match classify_data_read(r, seen, "stderr") {
+                    Ok(Some(n)) => {
+                        buf.extend_from_slice(&tmp[..n]);
+                        seen += n as u64;
+                    }
+                    Ok(None) => break,
+                    Err(e) => return (buf, Some(e)),
+                }
+            }
+            (buf, None)
+        }
+    };
+
+    // Wait for the EXIT notification on the control channel.
+    // Returns (exit_code, error_message, residual_bytes) where residual
+    // is anything read past the EXIT frame.
+    let exit_task = async {
+        let mut buf = Vec::with_capacity(256);
+        let mut tmp = [0u8; 4096];
+        loop {
+            let bytes_read = conn.control.read(&mut tmp).await.context("read control")?;
+            if bytes_read == 0 {
+                anyhow::bail!("control closed before EXIT");
+            }
+            buf.extend_from_slice(&tmp[..bytes_read]);
+
+            // Drain all complete messages before reading more data.
+            loop {
+                match decode_message(&buf).context("decode control")? {
+                    DecodeResult::Message {
+                        message: ControlMessage::Exit(exit),
+                        consumed,
+                    } => {
+                        buf.drain(..consumed);
+                        return Ok((exit.exit_code, exit.error_message, buf));
+                    }
+                    DecodeResult::Message {
+                        message: ControlMessage::Pong,
+                        consumed,
+                    } => {
+                        buf.drain(..consumed);
+                        // Continue inner loop to decode the next message.
+                    }
+                    DecodeResult::Message { message, .. } => {
+                        anyhow::bail!("unexpected control message: {:?}", message);
+                    }
+                    DecodeResult::Incomplete => break,
+                }
+            }
+        }
+    };
+
+    // Run stdin forwarding, stdout/stderr reads, and the exit notification all
+    // concurrently.
+    let (stdin_err, (stdout, stdout_err), (stderr, stderr_err), exit_result) =
+        tokio::join!(stdin_task, stdout_task, stderr_task, exit_task);
+
+    if let Some(e) = stdin_err {
+        eprintln!("[daemon] WARNING: forwarding stdin to guest failed (continuing): {e:#}");
+    }
+
+    let (exit_code, error_message, control_residual) = exit_result?;
+
+    // A read error on stdout/stderr means the captured output may be truncated.
+    // Do NOT present a truncated run as a clean success: if the guest reported
+    // exit 0 but a data channel errored mid-stream, surface a transport error
+    // (preserving the bytes already captured) instead of silently returning
+    // empty/partial output with exit 0. A non-zero exit already signals
+    // failure, so the bytes are returned as-is in that case.
+    if exit_code == 0 {
+        if let Some(e) = stdout_err.or(stderr_err) {
+            return Ok(ExecResult {
+                exit_code: -1,
+                error_message: format!(
+                    "transport error draining guest output (captured {} stdout / {} stderr \
+                     byte(s) before the error): {e}",
+                    stdout.len(),
+                    stderr.len()
+                ),
+                stdout,
+                stderr,
+                control_residual,
+            });
+        }
+    }
+
+    Ok(ExecResult {
+        exit_code,
+        error_message,
+        stdout,
+        stderr,
+        control_residual,
+    })
+}
+
+/// Wait for `StreamsReady`, then reconnect stdin/stdout/stderr.
+pub async fn reconnect_data_streams(
+    conn: &mut GuestConnection,
+    addr: SocketAddr,
+    control_residual: Vec<u8>,
+    nonce: &Nonce,
+) -> Result<()> {
+    let mut buf = control_residual;
+    let mut tmp = [0u8; 256];
+    let timeout = STREAMS_READY_TIMEOUT_SECS;
+    let deadline = tokio::time::Instant::now() + timeout;
+
+    loop {
+        loop {
+            match decode_message(&buf).context("decode StreamsReady")? {
+                DecodeResult::Message {
+                    message: ControlMessage::StreamsReady,
+                    consumed,
+                } => {
+                    buf.drain(..consumed);
+                    eprintln!("[daemon] received StreamsReady, reconnecting data streams");
+
+                    let connect_timeout = RECONNECT_TIMEOUT_SECS;
+                    let connect = |role: ChannelRole| {
+                        let target = addr;
+                        async move {
+                            let label = role.label();
+                            let mut stream =
+                                tokio::time::timeout(connect_timeout, TcpStream::connect(target))
+                                    .await
+                                    .with_context(|| {
+                                        format!("timeout reconnecting {} to {}", label, target)
+                                    })?
+                                    .with_context(|| {
+                                        format!("reconnect {} to {}", label, target)
+                                    })?;
+                            tokio::time::timeout(
+                                connect_timeout,
+                                auth::write_nonce(&mut stream, nonce, role),
+                            )
+                            .await
+                            .with_context(|| format!("timeout writing reconnect nonce on {label}"))?
+                            .with_context(|| {
+                                format!("write reconnect nonce on {label} to {target}")
+                            })?;
+                            Ok::<TcpStream, anyhow::Error>(stream)
+                        }
+                    };
+
+                    let (stdin_stream, stdout_stream, stderr_stream) = tokio::try_join!(
+                        connect(ChannelRole::Stdin),
+                        connect(ChannelRole::Stdout),
+                        connect(ChannelRole::Stderr),
+                    )?;
+                    conn.stdin_stream = stdin_stream;
+                    conn.stdout_stream = stdout_stream;
+                    conn.stderr_stream = stderr_stream;
+
+                    eprintln!("[daemon] data streams reconnected to {}", addr);
+                    return Ok(());
+                }
+                DecodeResult::Message {
+                    message: ControlMessage::Pong,
+                    consumed,
+                } => {
+                    buf.drain(..consumed);
+                    continue;
+                }
+                DecodeResult::Message { message, consumed } => {
+                    eprintln!(
+                        "[daemon] skipping unexpected message while waiting for StreamsReady: {:?}",
+                        message
+                    );
+                    buf.drain(..consumed);
+                    continue;
+                }
+                DecodeResult::Incomplete => break,
+            }
+        }
+
+        // Need more data from the control channel.
+        let remaining = deadline
+            .checked_duration_since(tokio::time::Instant::now())
+            .unwrap_or(Duration::ZERO);
+        let bytes_read = tokio::time::timeout(remaining, conn.control.read(&mut tmp))
+            .await
+            .context("timeout waiting for StreamsReady")?
+            .context("read control for StreamsReady")?;
+        if bytes_read == 0 {
+            anyhow::bail!("control closed before StreamsReady");
+        }
+        buf.extend_from_slice(&tmp[..bytes_read]);
+    }
+}
+
+/// Outcome of a streamed execution on the guest.
+pub struct StreamExecOutcome {
+    /// Control-channel bytes read past the `Exit` frame (may contain the
+    /// guest's `StreamsReady`). Hand this to [`reconnect_data_streams`].
+    pub control_residual: Vec<u8>,
+    /// `false` if the IPC writer (the exec-phase client) errored mid-stream and
+    /// was abandoned. The guest execution still ran to completion and the guest
+    /// connection is left in a clean, reusable state; only the client relay was
+    /// lost.
+    pub ipc_alive: bool,
+    /// The child's exit code, as reported by the guest `Exit` message. The
+    /// caller writes the terminal exit frame after restoring/releasing the
+    /// single-flight guest slot.
+    pub exit_code: i32,
+    /// The guest's error message accompanying the exit (empty on success).
+    pub error_message: String,
+}
+
+#[derive(Copy, Clone, Debug)]
+pub struct ExitFramePermit {
+    _private: (),
+}
+
+impl ExitFramePermit {
+    pub fn after_guest_slot_release() -> Self {
+        Self { _private: () }
+    }
+}
+
+/// Run one guest execution and stream stdout/stderr to the IPC client.
+///
+/// The terminal exit frame is written separately after the guest slot is
+/// restored for reuse.
+pub async fn stream_exec_on_guest<R, W>(
+    conn: &mut GuestConnection,
+    exec_id: &str,
+    req: &ExecStart,
+    ipc_reader: &mut R,
+    ipc: &mut W,
+) -> Result<StreamExecOutcome>
+where
+    R: tokio::io::AsyncRead + Unpin,
+    W: AsyncWrite + Unpin,
+{
+    let exec_msg = ControlMessage::Exec(ExecRequest {
+        exec_id: exec_id.to_string(),
+        script_code: req.script_code.clone(),
+        working_directory: req.working_directory.clone(),
+        timeout_ms: req.timeout_ms,
+    });
+    let frame = encode_message(&exec_msg).context("encode EXEC")?;
+    conn.control.write_all(&frame).await.context("send EXEC")?;
+
+    let control = &mut conn.control;
+    let stdout = &mut conn.stdout_stream;
+    let stderr = &mut conn.stderr_stream;
+    let stdin_out = &mut conn.stdin_stream;
+
+    let mut ipc_alive = true;
+    let mut stdout_done = false;
+    let mut stderr_done = false;
+    let mut stdin_in_done = false;
+    let mut stdin_out_closed = false;
+    let mut stdout_seen: u64 = 0;
+    let mut stderr_seen: u64 = 0;
+    let mut exit: Option<(i32, String)> = None;
+    let mut post_exit_deadline: Option<tokio::time::Instant> = None;
+    let mut ctrl_buf: Vec<u8> = Vec::with_capacity(256);
+    let mut so = [0u8; 8192];
+    let mut se = [0u8; 8192];
+    let mut cb = [0u8; 4096];
+
+    while !(stdout_done && stderr_done && exit.is_some()) {
+        tokio::select! {
+            r = stdout.read(&mut so), if !stdout_done => {
+                match classify_data_read(r, stdout_seen, "stdout")? {
+                    None => {
+                        stdout_done = true;
+                    }
+                    Some(n) => {
+                        stdout_seen += n as u64;
+                        if ipc_alive
+                            && !write_data_frame_split(ipc, FrameKind::Stdout, &so[..n]).await
+                        {
+                            ipc_alive = false;
+                        }
+                    }
+                }
+            }
+            r = stderr.read(&mut se), if !stderr_done => {
+                match classify_data_read(r, stderr_seen, "stderr")? {
+                    None => {
+                        stderr_done = true;
+                    }
+                    Some(n) => {
+                        stderr_seen += n as u64;
+                        if ipc_alive
+                            && !write_data_frame_split(ipc, FrameKind::Stderr, &se[..n]).await
+                        {
+                            ipc_alive = false;
+                        }
+                    }
+                }
+            }
+            r = ipc_exec::read_frame_async(ipc_reader), if !stdin_in_done => {
+                match r {
+                    Ok(None) => {
+                        stdin_in_done = true;
+                        if !stdin_out_closed {
+                            let _ = stdin_out.shutdown().await;
+                            stdin_out_closed = true;
+                        }
+                    }
+                    Ok(Some(frame)) if frame.kind == Some(FrameKind::Stdin) => {
+                        if !frame.payload.is_empty() && !stdin_out_closed {
+                            if let Err(e) = stdin_out.write_all(&frame.payload).await {
+                                eprintln!(
+                                    "[daemon] guest stdin write failed: {e}; closing stdin and \
+                                     continuing exec"
+                                );
+                                let _ = stdin_out.shutdown().await;
+                                stdin_out_closed = true;
+                            }
+                        }
+                    }
+                    Ok(Some(frame)) => {
+                        eprintln!(
+                            "[daemon] ignoring unexpected IPC frame kind {} during exec",
+                            frame.raw_kind
+                        );
+                    }
+                    Err(e) => {
+                        eprintln!("[daemon] IPC stdin reader errored: {e}; closing guest stdin");
+                        stdin_in_done = true;
+                        if !stdin_out_closed {
+                            let _ = stdin_out.shutdown().await;
+                            stdin_out_closed = true;
+                        }
+                    }
+                }
+            }
+            r = control.read(&mut cb), if exit.is_none() => {
+                let n = r.context("read guest control")?;
+                if n == 0 {
+                    anyhow::bail!("guest control closed before Exit");
+                }
+                ctrl_buf.extend_from_slice(&cb[..n]);
+                loop {
+                    match decode_message(&ctrl_buf).context("decode control")? {
+                        DecodeResult::Message {
+                            message: ControlMessage::Exit(e),
+                            consumed,
+                        } => {
+                            ctrl_buf.drain(..consumed);
+                            exit = Some((e.exit_code, e.error_message));
+                            post_exit_deadline =
+                                Some(tokio::time::Instant::now() + POST_EXIT_DRAIN_SECS);
+                            if !stdin_out_closed {
+                                let _ = stdin_out.shutdown().await;
+                                stdin_out_closed = true;
+                            }
+                            stdin_in_done = true;
+                            break;
+                        }
+                        DecodeResult::Message {
+                            message: ControlMessage::Pong,
+                            consumed,
+                        } => {
+                            ctrl_buf.drain(..consumed);
+                        }
+                        DecodeResult::Message { message, consumed } => {
+                            eprintln!("[daemon] unexpected control during exec: {message:?}");
+                            ctrl_buf.drain(..consumed);
+                        }
+                        DecodeResult::Incomplete => break,
+                    }
+                }
+            }
+            _ = async {
+                match post_exit_deadline {
+                    Some(d) => tokio::time::sleep_until(d).await,
+                    None => std::future::pending::<()>().await,
+                }
+            }, if exit.is_some() && !(stdout_done && stderr_done) => {
+                eprintln!(
+                    "[daemon] post-exit drain timed out after {:?}; abandoning stdout/stderr (possible leaked guest descendant holding the pipes)",
+                    POST_EXIT_DRAIN_SECS
+                );
+                stdout_done = true;
+                stderr_done = true;
+            }
+        }
+    }
+
+    let (exit_code, error_message) = match exit {
+        Some(e) => e,
+        None => anyhow::bail!("internal: exec loop ended without an exit notification"),
+    };
+
+    Ok(StreamExecOutcome {
+        control_residual: ctrl_buf,
+        ipc_alive,
+        exit_code,
+        error_message,
+    })
+}
+
+/// Write the terminal exit frame to the IPC client.
+///
+/// Write the final exit frame after the guest slot is reusable.
+pub async fn write_exit_frame<W>(
+    ipc: &mut W,
+    _permit: ExitFramePermit,
+    exit_code: i32,
+    error_message: &str,
+) -> Result<bool>
+where
+    W: AsyncWrite + Unpin,
+{
+    let frame =
+        ipc_exec::encode_exit_frame(exit_code, error_message).context("encode exit frame")?;
+    let ok = write_ipc(ipc, &frame).await
+        && matches!(
+            tokio::time::timeout(IPC_WRITE_TIMEOUT_SECS, ipc.flush()).await,
+            Ok(Ok(()))
+        );
+    Ok(ok)
+}
+
+/// Classify a data-stream (`stdout`/`stderr`) read result.
+fn classify_data_read(r: std::io::Result<usize>, seen: u64, label: &str) -> Result<Option<usize>> {
+    use std::io::ErrorKind;
+    match r {
+        Ok(0) => Ok(None),
+        Ok(n) => Ok(Some(n)),
+        Err(e)
+            if seen == 0
+                && matches!(
+                    e.kind(),
+                    ErrorKind::ConnectionReset
+                        | ErrorKind::ConnectionAborted
+                        | ErrorKind::BrokenPipe
+                ) =>
+        {
+            eprintln!(
+                "[daemon] guest {label} reset with no data ({:?}); treating as EOF",
+                e.kind()
+            );
+            Ok(None)
+        }
+        Err(e) => {
+            Err(anyhow::Error::new(e).context(format!("read guest {label} after {seen} bytes")))
+        }
+    }
+}
+
+/// Write a frame to the IPC client with a bounded timeout.
+async fn write_ipc<W>(ipc: &mut W, frame: &[u8]) -> bool
+where
+    W: AsyncWrite + Unpin,
+{
+    matches!(
+        tokio::time::timeout(IPC_WRITE_TIMEOUT_SECS, ipc.write_all(frame),).await,
+        Ok(Ok(()))
+    )
+}
+
+/// Write a data frame without allocating a combined header+payload buffer.
+async fn write_data_frame_split<W>(ipc: &mut W, kind: FrameKind, payload: &[u8]) -> bool
+where
+    W: AsyncWrite + Unpin,
+{
+    let header = ipc_exec::frame_header(kind, payload.len());
+    let combined = async {
+        ipc.write_all(&header).await?;
+        ipc.write_all(payload).await?;
+        Ok::<(), std::io::Error>(())
+    };
+    matches!(
+        tokio::time::timeout(IPC_WRITE_TIMEOUT_SECS, combined).await,
+        Ok(Ok(()))
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::{Error, ErrorKind};
+    use std::net::SocketAddr;
+    use tokio::net::TcpListener;
+    use tokio::sync::oneshot;
+    use windows_sandbox_common::auth::generate_nonce;
+    use windows_sandbox_common::sandbox_protocol::{encode_message, encode_preamble};
+
+    #[test]
+    fn classify_data_read_clean_eof_is_none() {
+        assert_eq!(classify_data_read(Ok(0), 0, "stdout").unwrap(), None);
+        // A clean FIN is EOF even after bytes were observed.
+        assert_eq!(classify_data_read(Ok(0), 42, "stdout").unwrap(), None);
+    }
+
+    #[test]
+    fn classify_data_read_some_bytes_passes_through() {
+        assert_eq!(classify_data_read(Ok(7), 0, "stderr").unwrap(), Some(7));
+        assert_eq!(classify_data_read(Ok(3), 100, "stderr").unwrap(), Some(3));
+    }
+
+    #[test]
+    fn classify_data_read_reset_with_no_data_is_eof() {
+        // The narrow defensive case: a reset-class error before any byte was
+        // seen is treated as EOF (RST racing ahead of FIN on the zero-output
+        // path).
+        for kind in [
+            ErrorKind::ConnectionReset,
+            ErrorKind::ConnectionAborted,
+            ErrorKind::BrokenPipe,
+        ] {
+            let r = Err(Error::new(kind, "reset"));
+            assert_eq!(
+                classify_data_read(r, 0, "stdout").unwrap(),
+                None,
+                "reset kind {kind:?} with no bytes should be EOF"
+            );
+        }
+    }
+
+    #[test]
+    fn classify_data_read_reset_after_bytes_is_error() {
+        // Once any byte was relayed, a reset must be a hard error so we never
+        // silently truncate output.
+        let r = Err(Error::new(ErrorKind::ConnectionReset, "reset"));
+        assert!(classify_data_read(r, 1, "stdout").is_err());
+    }
+
+    #[test]
+    fn classify_data_read_other_error_is_error_regardless_of_seen() {
+        let r = Err(Error::new(ErrorKind::NotConnected, "nope"));
+        assert!(classify_data_read(r, 0, "stderr").is_err());
+        let r = Err(Error::new(ErrorKind::NotConnected, "nope"));
+        assert!(classify_data_read(r, 5, "stderr").is_err());
+    }
+
+    #[tokio::test]
+    async fn write_exit_frame_emits_single_decodable_exit_frame() {
+        // The terminal exit frame is written by the caller (after releasing
+        // the single-flight slot). Verify the extracted helper
+        // emits exactly one decodable exit frame and reports the client alive.
+        let mut buf: Vec<u8> = Vec::new();
+        let alive = write_exit_frame(
+            &mut buf,
+            ExitFramePermit::after_guest_slot_release(),
+            7,
+            "boom",
+        )
+        .await
+        .unwrap();
+        assert!(alive, "an in-memory writer never errors");
+
+        let mut cur = std::io::Cursor::new(buf);
+        let frame = ipc_exec::read_frame(&mut cur)
+            .unwrap()
+            .expect("one exit frame");
+        assert_eq!(frame.kind, Some(FrameKind::Exit));
+        let exit: ipc_exec::ExecExit = serde_json::from_slice(&frame.payload).unwrap();
+        assert_eq!(exit.exit_code, 7);
+        assert_eq!(exit.error_message, "boom");
+        assert!(
+            ipc_exec::read_frame(&mut cur).unwrap().is_none(),
+            "no trailing frames after the terminal exit frame"
+        );
+    }
+
+    // In-process guest for bridge and reconnect integration tests.
+
+    struct FakeGuestSide {
+        control: tokio::net::TcpStream,
+        stdin: tokio::net::TcpStream,
+        stdout: tokio::net::TcpStream,
+        stderr: tokio::net::TcpStream,
+        #[allow(dead_code)]
+        listener: TcpListener,
+        #[allow(dead_code)]
+        addr: SocketAddr,
+    }
+
+    /// Spawn an authenticated fake guest that pairs sockets by declared role.
+    async fn spawn_fake_guest(
+        nonce: windows_sandbox_common::auth::Nonce,
+    ) -> (
+        SocketAddr,
+        oneshot::Receiver<Result<FakeGuestSide, std::io::Error>>,
+    ) {
+        use windows_sandbox_common::auth::ChannelRole;
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let addr = listener.local_addr().unwrap();
+        let (tx, rx) = oneshot::channel();
+        tokio::spawn(async move {
+            let result: Result<FakeGuestSide, std::io::Error> = async {
+                let accept_one = || async {
+                    let (mut s, _) = listener.accept().await?;
+                    let mut buf = [0u8; windows_sandbox_common::auth::NONCE_LEN_IN_BYTES];
+                    s.read_exact(&mut buf).await?;
+                    let got = windows_sandbox_common::auth::Nonce::from_bytes(&buf)
+                        .expect("read_exact filled the nonce buffer");
+                    if !nonce.constant_time_eq(&got) {
+                        return Err(std::io::Error::new(
+                            std::io::ErrorKind::InvalidData,
+                            "bad nonce on fake-guest accept",
+                        ));
+                    }
+                    let mut role_buf = [0u8; 1];
+                    s.read_exact(&mut role_buf).await?;
+                    let role = ChannelRole::from_wire(role_buf[0]).ok_or_else(|| {
+                        std::io::Error::new(
+                            std::io::ErrorKind::InvalidData,
+                            format!("unknown channel role 0x{:02x}", role_buf[0]),
+                        )
+                    })?;
+                    Ok::<(tokio::net::TcpStream, ChannelRole), std::io::Error>((s, role))
+                };
+                let mut control: Option<tokio::net::TcpStream> = None;
+                let mut stdin_stream: Option<tokio::net::TcpStream> = None;
+                let mut stdout_stream: Option<tokio::net::TcpStream> = None;
+                let mut stderr_stream: Option<tokio::net::TcpStream> = None;
+                for _ in 0..4 {
+                    let (s, role) = accept_one().await?;
+                    let slot = match role {
+                        ChannelRole::Control => &mut control,
+                        ChannelRole::Stdin => &mut stdin_stream,
+                        ChannelRole::Stdout => &mut stdout_stream,
+                        ChannelRole::Stderr => &mut stderr_stream,
+                    };
+                    if slot.is_some() {
+                        return Err(std::io::Error::new(
+                            std::io::ErrorKind::InvalidData,
+                            format!("duplicate role {:?} on fake-guest accept", role),
+                        ));
+                    }
+                    *slot = Some(s);
+                }
+                let mut control = control.expect("control role declared");
+                let stdin = stdin_stream.expect("stdin role declared");
+                let stdout = stdout_stream.expect("stdout role declared");
+                let stderr = stderr_stream.expect("stderr role declared");
+                control.write_all(&encode_preamble()).await?;
+                let ready = encode_message(&ControlMessage::Ready).expect("encode Ready");
+                control.write_all(&ready).await?;
+                Ok(FakeGuestSide {
+                    control,
+                    stdin,
+                    stdout,
+                    stderr,
+                    listener,
+                    addr,
+                })
+            }
+            .await;
+            let _ = tx.send(result);
+        });
+        (addr, rx)
+    }
+
+    #[tokio::test]
+    async fn stream_exec_relays_stdout_stderr_exit_to_ipc_client() {
+        let nonce = generate_nonce().expect("generate nonce");
+        let (addr, fake_rx) = spawn_fake_guest(nonce.clone()).await;
+        let mut conn = connect_to_guest(addr, Duration::from_secs(5), &nonce)
+            .await
+            .expect("connect_to_guest must succeed");
+        let mut fake = fake_rx
+            .await
+            .expect("fake-guest oneshot")
+            .expect("fake-guest accept");
+
+        let mut ipc_reader: &[u8] = b"";
+        let mut ipc_writer: Vec<u8> = Vec::new();
+        let req = ExecStart {
+            script_code: "echo hi".to_string(),
+            working_directory: String::new(),
+            timeout_ms: 5_000,
+        };
+
+        let fake_side = async {
+            let mut buf = [0u8; 4096];
+            let _ = fake.control.read(&mut buf).await;
+            fake.stdout.write_all(b"hi").await.unwrap();
+            fake.stdout.shutdown().await.ok();
+            fake.stderr.write_all(b"warn").await.unwrap();
+            fake.stderr.shutdown().await.ok();
+            let exit = encode_message(&ControlMessage::Exit(
+                windows_sandbox_common::sandbox_protocol::ExitNotification {
+                    exec_id: "exec-test".to_string(),
+                    exit_code: 0,
+                    error_message: String::new(),
+                },
+            ))
+            .unwrap();
+            fake.control.write_all(&exit).await.unwrap();
+            fake
+        };
+
+        let host_side = stream_exec_on_guest(
+            &mut conn,
+            "exec-test",
+            &req,
+            &mut ipc_reader,
+            &mut ipc_writer,
+        );
+
+        let (_fake_back, outcome) = tokio::join!(fake_side, host_side);
+        let outcome = outcome.expect("stream_exec_on_guest");
+        assert_eq!(outcome.exit_code, 0);
+        assert_eq!(outcome.error_message, "");
+        assert!(outcome.ipc_alive);
+
+        let mut cur = std::io::Cursor::new(ipc_writer);
+        let mut stdout_seen = Vec::new();
+        let mut stderr_seen = Vec::new();
+        while let Some(frame) = ipc_exec::read_frame(&mut cur).unwrap() {
+            match frame.kind {
+                Some(FrameKind::Stdout) => stdout_seen.extend_from_slice(&frame.payload),
+                Some(FrameKind::Stderr) => stderr_seen.extend_from_slice(&frame.payload),
+                other => panic!("unexpected frame kind during stream test: {other:?}"),
+            }
+        }
+        assert_eq!(stdout_seen, b"hi");
+        assert_eq!(stderr_seen, b"warn");
+    }
+
+    #[tokio::test]
+    async fn stream_exec_forwards_frame_stdin_to_guest() {
+        let nonce = generate_nonce().expect("generate nonce");
+        let (addr, fake_rx) = spawn_fake_guest(nonce.clone()).await;
+        let mut conn = connect_to_guest(addr, Duration::from_secs(5), &nonce)
+            .await
+            .unwrap();
+        let mut fake = fake_rx.await.unwrap().unwrap();
+
+        let (mut ipc_writer_side, mut ipc_reader_side) = tokio::io::duplex(4096);
+        let stdin_frame = ipc_exec::encode_frame(FrameKind::Stdin, b"input data");
+        ipc_writer_side.write_all(&stdin_frame).await.unwrap();
+        drop(ipc_writer_side); // EOF on the IPC reader
+
+        let mut ipc_out: Vec<u8> = Vec::new();
+        let req = ExecStart {
+            script_code: "cat".to_string(),
+            working_directory: String::new(),
+            timeout_ms: 5_000,
+        };
+
+        let fake_side = async {
+            let mut buf = [0u8; 4096];
+            let _ = fake.control.read(&mut buf).await;
+            // Read whatever lands on fake stdin (forwarded by daemon).
+            let mut stdin_recv = Vec::new();
+            // Bound the read so a regression where stdin never closes does
+            // not hang the test forever.
+            let _ = tokio::time::timeout(
+                Duration::from_secs(2),
+                fake.stdin.read_to_end(&mut stdin_recv),
+            )
+            .await;
+            // Close stdout/stderr cleanly so the host's exec drain exits.
+            fake.stdout.shutdown().await.ok();
+            fake.stderr.shutdown().await.ok();
+            let exit = encode_message(&ControlMessage::Exit(
+                windows_sandbox_common::sandbox_protocol::ExitNotification {
+                    exec_id: "exec-stdin".to_string(),
+                    exit_code: 0,
+                    error_message: String::new(),
+                },
+            ))
+            .unwrap();
+            fake.control.write_all(&exit).await.unwrap();
+            stdin_recv
+        };
+
+        let host_side = stream_exec_on_guest(
+            &mut conn,
+            "exec-stdin",
+            &req,
+            &mut ipc_reader_side,
+            &mut ipc_out,
+        );
+
+        let (stdin_recv, outcome) = tokio::join!(fake_side, host_side);
+        outcome.expect("stream_exec_on_guest");
+        assert_eq!(
+            stdin_recv, b"input data",
+            "guest stdin must receive forwarded bytes"
+        );
+    }
+
+    #[tokio::test]
+    async fn stream_exec_survives_ipc_client_disconnect_mid_stream() {
+        // If the IPC client (wxc-exec) disconnects mid-stream the guest
+        // execution must still run to completion and the connection must
+        // stay in a clean reusable state. ipc_alive should be false but
+        // exit_code populated normally. Review robustness contract on
+        // stream_exec_on_guest.
+        let nonce = generate_nonce().expect("generate nonce");
+        let (addr, fake_rx) = spawn_fake_guest(nonce.clone()).await;
+        let mut conn = connect_to_guest(addr, Duration::from_secs(5), &nonce)
+            .await
+            .unwrap();
+        let mut fake = fake_rx.await.unwrap().unwrap();
+
+        let (ipc_client_side, ipc_server_side) = tokio::io::duplex(64);
+        // Daemon writes flow to `ipc_server_side`'s write half (which the
+        // client would read). When we drop ipc_client_side, the daemon's
+        // write returns EOF.
+        let (server_read, mut server_write) = tokio::io::split(ipc_server_side);
+        let mut empty_reader: &[u8] = b"";
+
+        let req = ExecStart {
+            script_code: "long-running".to_string(),
+            working_directory: String::new(),
+            timeout_ms: 5_000,
+        };
+
+        let fake_side = async {
+            let mut buf = [0u8; 4096];
+            let _ = fake.control.read(&mut buf).await;
+            // Spew enough stdout that the daemon's write to the (now-
+            // disconnected) IPC writer fails. 64 KiB exceeds the duplex
+            // buffer many times over.
+            for _ in 0..16 {
+                fake.stdout.write_all(&[b'x'; 4096]).await.ok();
+            }
+            fake.stdout.shutdown().await.ok();
+            fake.stderr.shutdown().await.ok();
+            let exit = encode_message(&ControlMessage::Exit(
+                windows_sandbox_common::sandbox_protocol::ExitNotification {
+                    exec_id: "exec-disco".to_string(),
+                    exit_code: 0,
+                    error_message: String::new(),
+                },
+            ))
+            .unwrap();
+            fake.control.write_all(&exit).await.unwrap();
+        };
+
+        drop(ipc_client_side);
+        drop(server_read);
+
+        let host_side = stream_exec_on_guest(
+            &mut conn,
+            "exec-disco",
+            &req,
+            &mut empty_reader,
+            &mut server_write,
+        );
+
+        let (_fake, outcome) = tokio::join!(fake_side, host_side);
+        let outcome = outcome.expect("stream_exec_on_guest must still complete");
+        assert!(
+            !outcome.ipc_alive,
+            "ipc_alive must be false after client disconnect"
+        );
+        assert_eq!(outcome.exit_code, 0);
+    }
+}
diff --git a/src/backends/windows_sandbox/lifecycle/src/constants.rs b/src/backends/windows_sandbox/lifecycle/src/constants.rs
new file mode 100644
index 000000000..aeaa18bc8
--- /dev/null
+++ b/src/backends/windows_sandbox/lifecycle/src/constants.rs
@@ -0,0 +1,7 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Constants shared across Windows Sandbox lifecycle consumers.
+
+/// Host-side state-aware daemon binary.
+pub const DAEMON_BINARY_NAME: &str = "wxc-windows-sandbox-daemon.exe";
diff --git a/src/backends/windows_sandbox/lifecycle/src/control_plane.rs b/src/backends/windows_sandbox/lifecycle/src/control_plane.rs
new file mode 100644
index 000000000..92df6817d
--- /dev/null
+++ b/src/backends/windows_sandbox/lifecycle/src/control_plane.rs
@@ -0,0 +1,1195 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Durable records and locks for the state-aware Windows Sandbox daemon.
+//!
+//! Records live under [`state_aware_root`]. Each write is atomic and
+//! schema-versioned so crashes and future format changes fail closed.
+
+use std::path::{Path, PathBuf};
+
+use anyhow::{Context, Result};
+use serde::{Deserialize, Serialize};
+
+pub mod os;
+pub use os::*;
+
+/// Current on-disk record schema. Bump when the record shape changes
+/// incompatibly; readers reject mismatches via [`check_schema`].
+pub const RECORD_SCHEMA_VERSION: u32 = 1;
+
+/// Lifecycle state of a provisioned state-aware sandbox.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum SandboxState {
+    /// Bookkeeping exists (record + policy snapshot); no daemon, no VM.
+    Provisioned,
+    /// The daemon is up and holds a live VM + guest connection.
+    Started,
+    /// The VM has been torn down; the record persists for a later `start`.
+    Stopped,
+}
+
+/// A serialisable snapshot of one mapped folder, mirroring [`crate::vm::MappedFolder`]
+/// but decoupled from it so the on-disk format is independent of the in-memory
+/// type.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct MappedFolderRecord {
+    pub host: String,
+    pub sandbox: String,
+    pub read_only: bool,
+}
+
+/// Per-sandbox durable record (`<token>\record.json`).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct SandboxRecord {
+    pub schema_version: u32,
+    pub sandbox_id: String,
+    pub state: SandboxState,
+    /// Filesystem-policy snapshot captured at provision and applied verbatim at
+    /// every `start`. Immutable for the life of the sandbox.
+    pub mapped_folders: Vec<MappedFolderRecord>,
+}
+
+impl SandboxRecord {
+    /// Construct a freshly-provisioned record.
+    pub fn new_provisioned(sandbox_id: String, mapped_folders: Vec<MappedFolderRecord>) -> Self {
+        Self {
+            schema_version: RECORD_SCHEMA_VERSION,
+            sandbox_id,
+            state: SandboxState::Provisioned,
+            mapped_folders,
+        }
+    }
+}
+
+/// Identity of a single Windows Sandbox host process: its PID paired with its
+/// creation time (Win32 `FILETIME`, 100ns ticks). The creation time pins the
+/// PID to a specific process instance so PID reuse cannot cause a false match.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub struct VmProcId {
+    pub pid: u32,
+    pub creation_time: u64,
+}
+
+/// Global daemon record (`daemon.json`). Present iff a daemon is (or recently
+/// was) alive.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct DaemonRecord {
+    pub schema_version: u32,
+    /// Daemon process id.
+    pub pid: u32,
+    /// Daemon process creation time (Win32 `FILETIME`, 100ns ticks). Paired
+    /// with `pid` to defeat PID reuse: a recycled PID will not match.
+    pub pid_creation_time: u64,
+    /// Localhost TCP port the daemon serves its line protocol on.
+    pub ipc_port: u16,
+    /// Shared secret the backend generated and passed to the daemon at spawn.
+    /// Echoed here so the backend can (a) confirm this record belongs to the
+    /// daemon it just spawned and (b) authenticate later IPC connects against a
+    /// process squatting the port.
+    pub nonce: String,
+    /// The single sandbox this daemon currently holds.
+    pub active_sandbox_id: String,
+    /// `false` while the daemon is booting; `true` once the VM is ready.
+    pub ready: bool,
+    /// Positive ownership proof for reclaiming an orphaned VM.
+    #[serde(default)]
+    pub vm_processes: Vec<VmProcId>,
+}
+
+/// Startup action for an already-running VM.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum StartupAction {
+    Proceed,
+    /// A stale record proves the running VM is ours; reclaim it before launch.
+    ReclaimOrphan {
+        proof: Vec<VmProcId>,
+    },
+    /// A VM is running, but ownership is not proven.
+    RefuseForeign,
+}
+
+/// Reclaim only when a stale record's proof intersects the live VM process set.
+pub fn classify_startup(prior: Option<&DaemonRecord>, current_vm: &[VmProcId]) -> StartupAction {
+    if current_vm.is_empty() {
+        return StartupAction::Proceed;
+    }
+    if let Some(prior) = prior {
+        let ours = prior
+            .vm_processes
+            .iter()
+            .any(|recorded| current_vm.contains(recorded));
+        if ours {
+            return StartupAction::ReclaimOrphan {
+                proof: prior.vm_processes.clone(),
+            };
+        }
+    }
+    StartupAction::RefuseForeign
+}
+
+/// How far VM ownership has progressed within one daemon process.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum VmOwnership {
+    NotLaunched,
+    /// Launch issued, but success not observed; cleanup must not tear down.
+    LaunchInFlight,
+    /// Launch succeeded, but host-process proof is not available yet.
+    LaunchSucceededNoProof,
+    /// Launch succeeded and host-process proof was captured.
+    Owned(Vec<VmProcId>),
+}
+
+/// Cleanup action derived from ownership state.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum CleanupAction {
+    Noop,
+    /// Ownership is unproven; leave any VM alone.
+    LeakUnowned,
+    /// Tear down using the provided proof seed.
+    Teardown(Vec<VmProcId>),
+}
+
+/// Map ownership state to the daemon exit cleanup action.
+pub fn decide_cleanup(ownership: &VmOwnership) -> CleanupAction {
+    match ownership {
+        VmOwnership::NotLaunched => CleanupAction::Noop,
+        VmOwnership::LaunchInFlight => CleanupAction::LeakUnowned,
+        VmOwnership::LaunchSucceededNoProof => CleanupAction::Teardown(Vec::new()),
+        VmOwnership::Owned(pids) => CleanupAction::Teardown(pids.clone()),
+    }
+}
+
+/// Compute the process identities safe to terminate for a proven VM owner.
+pub fn plan_kill_set(ownership: &VmOwnership, snapshot: &[VmProcId]) -> Option<Vec<VmProcId>> {
+    match ownership {
+        VmOwnership::NotLaunched | VmOwnership::LaunchInFlight => None,
+        VmOwnership::Owned(proof) => {
+            let intersects = proof.iter().any(|p| snapshot.contains(p));
+            if intersects {
+                let mut kill = proof.clone();
+                for p in snapshot {
+                    if !kill.contains(p) {
+                        kill.push(*p);
+                    }
+                }
+                Some(kill)
+            } else {
+                Some(proof.clone())
+            }
+        }
+        VmOwnership::LaunchSucceededNoProof => {
+            if snapshot.is_empty() {
+                None
+            } else {
+                Some(snapshot.to_vec())
+            }
+        }
+    }
+}
+
+/// Teardown result controlling whether durable ownership records may be removed.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum TeardownOutcome {
+    /// All host processes exited; the durable record may be removed.
+    ConfirmedGone,
+    /// Processes remain after the timeout; preserve the record.
+    StillRunning(Vec<VmProcId>),
+    /// Liveness could not be determined; preserve the record.
+    ProbeFailed,
+}
+
+/// Cleanup decision when a sandbox record exists without a live daemon.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum StaleDaemonCleanup {
+    /// No live VM and no stale record (or stale record matches sandbox_id
+    /// with no live processes). Phase may advance normally.
+    NoLiveVm,
+    /// Stale daemon's proof intersects the live VM; safe to reclaim.
+    Reclaim { proof: Vec<VmProcId> },
+    /// Live VM exists but is foreign; refuse and surface its PIDs.
+    RefuseForeign { live: Vec<VmProcId> },
+    /// Liveness probe failed; refuse to act on unknown state.
+    RefuseProbeFailed,
+    /// Stale record names a different sandbox; refuse so we never act on
+    /// another sandbox's records.
+    RefuseSandboxIdMismatch { stale_active: String },
+}
+
+/// Classify stale-daemon cleanup without touching the host.
+///
+/// A sandbox-id mismatch is checked first so one sandbox can never authorise
+/// cleanup of another. `live == None` means the liveness probe failed.
+pub fn classify_stale_daemon_cleanup(
+    stale: Option<&DaemonRecord>,
+    sandbox_id: &str,
+    live: Option<&[VmProcId]>,
+) -> StaleDaemonCleanup {
+    if let Some(stale) = stale {
+        if stale.active_sandbox_id != sandbox_id {
+            return StaleDaemonCleanup::RefuseSandboxIdMismatch {
+                stale_active: stale.active_sandbox_id.clone(),
+            };
+        }
+    }
+    let live = match live {
+        None => return StaleDaemonCleanup::RefuseProbeFailed,
+        Some(l) => l,
+    };
+    if live.is_empty() {
+        return StaleDaemonCleanup::NoLiveVm;
+    }
+    if let Some(stale) = stale {
+        let intersects = stale.vm_processes.iter().any(|p| live.contains(p));
+        if intersects {
+            return StaleDaemonCleanup::Reclaim {
+                proof: stale.vm_processes.clone(),
+            };
+        }
+    }
+    StaleDaemonCleanup::RefuseForeign {
+        live: live.to_vec(),
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Paths
+// ---------------------------------------------------------------------------
+
+/// Root directory for state-aware records.
+pub fn state_aware_root() -> PathBuf {
+    #[cfg(test)]
+    {
+        if let Some(p) = test_root::get() {
+            return p;
+        }
+    }
+    std::env::temp_dir().join("wxc-wsb").join("state-aware")
+}
+
+/// Create and secure the record root before reading trusted state from it.
+pub fn secure_record_root() -> Result<()> {
+    os::ensure_secure_dir(&state_aware_root())
+}
+
+#[cfg(test)]
+mod test_root {
+    use std::path::PathBuf;
+    use std::sync::{Mutex, OnceLock};
+
+    static OVERRIDE: OnceLock<Mutex<Option<PathBuf>>> = OnceLock::new();
+    fn slot() -> &'static Mutex<Option<PathBuf>> {
+        OVERRIDE.get_or_init(|| Mutex::new(None))
+    }
+    pub fn set(p: Option<PathBuf>) {
+        *slot().lock().expect("test_root mutex poisoned") = p;
+    }
+    pub fn get() -> Option<PathBuf> {
+        slot().lock().expect("test_root mutex poisoned").clone()
+    }
+}
+
+/// Redirect [`state_aware_root`] for a test.
+#[cfg(test)]
+pub fn set_state_aware_root_for_test(path: Option<PathBuf>) {
+    test_root::set(path);
+}
+
+/// Serialises tests that override [`state_aware_root`].
+#[cfg(test)]
+pub static STATE_AWARE_TEST_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
+
+/// Per-sandbox scratch directory: `<root>\<token>`.
+///
+/// `token` is the tail of `sandbox_id` (`wsb:<token>`); callers pass the bare
+/// token so the path stays free of the `:` separator.
+pub fn sandbox_dir(token: &str) -> PathBuf {
+    state_aware_root().join(token)
+}
+
+/// Per-sandbox record file: `<root>\<token>\record.json`.
+pub fn sandbox_record_path(token: &str) -> PathBuf {
+    sandbox_dir(token).join("record.json")
+}
+
+/// Global daemon record file: `<root>\daemon.json`.
+pub fn daemon_record_path() -> PathBuf {
+    state_aware_root().join("daemon.json")
+}
+
+/// Serialise a JSON record through an atomic same-directory rename.
+pub fn atomic_write_json<T: Serialize>(path: &Path, value: &T) -> Result<()> {
+    let parent = path
+        .parent()
+        .context("record path has no parent directory")?;
+    std::fs::create_dir_all(parent).with_context(|| format!("create record dir {:?}", parent))?;
+
+    // Secure the directory before creating the temp file. A later DACL change
+    // would not revoke an attacker's already-open handle to a nonce-bearing file.
+    os::set_owner_only_dir(parent).with_context(|| format!("secure record dir {:?}", parent))?;
+
+    let json = serde_json::to_vec_pretty(value).context("serialise record")?;
+    let tmp = parent.join(format!("{}.tmp", uuid::Uuid::new_v4()));
+    std::fs::write(&tmp, &json).with_context(|| format!("write temp record {:?}", tmp))?;
+
+    // Belt-and-braces: also secure the file and fail closed before publishing it.
+    if let Err(e) = os::set_owner_only_file(&tmp) {
+        let _ = std::fs::remove_file(&tmp);
+        return Err(e).with_context(|| format!("secure record DACL {:?}", tmp));
+    }
+
+    if let Err(e) = std::fs::rename(&tmp, path) {
+        let _ = std::fs::remove_file(&tmp);
+        return Err(e).with_context(|| format!("rename {:?} -> {:?}", tmp, path));
+    }
+    Ok(())
+}
+
+/// Read and deserialise a JSON record. Returns `Ok(None)` if the file does not
+/// exist; an `Err` for a present-but-unreadable / unparseable file.
+pub fn read_json<T: for<'de> Deserialize<'de>>(path: &Path) -> Result<Option<T>> {
+    match std::fs::read_to_string(path) {
+        Ok(s) => {
+            let value =
+                serde_json::from_str(&s).with_context(|| format!("parse record {:?}", path))?;
+            Ok(Some(value))
+        }
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
+        Err(e) => Err(e).with_context(|| format!("read record {:?}", path)),
+    }
+}
+
+/// Reject a record whose schema does not match what this build understands.
+pub fn check_schema(found: u32, what: &str) -> Result<()> {
+    if found != RECORD_SCHEMA_VERSION {
+        anyhow::bail!(
+            "{} record schema {} is incompatible with supported schema {}",
+            what,
+            found,
+            RECORD_SCHEMA_VERSION
+        );
+    }
+    Ok(())
+}
+
+// ---------------------------------------------------------------------------
+// Daemon liveness
+// ---------------------------------------------------------------------------
+
+/// True iff the daemon described by `record` is still the live process it
+/// claims to be: a process with its PID is **currently running** AND its
+/// creation time matches the recorded one. Uses the liveness-aware
+/// [`running_process_creation_time`] so a terminated daemon whose object
+/// lingers behind a retained handle is correctly reported as gone rather than
+/// blocking a fresh daemon from reclaiming the slot.
+pub fn daemon_alive(record: &DaemonRecord) -> bool {
+    running_process_creation_time(record.pid) == Some(record.pid_creation_time)
+}
+
+/// Generate a fresh random auth nonce for the daemon record.
+pub fn generate_nonce() -> String {
+    uuid::Uuid::new_v4().simple().to_string()
+}
+
+// ---------------------------------------------------------------------------
+// Record convenience readers
+// ---------------------------------------------------------------------------
+
+/// Read the per-sandbox record for `token`, validating its schema. Returns
+/// `Ok(None)` if the record does not exist.
+pub fn read_sandbox_record(token: &str) -> Result<Option<SandboxRecord>> {
+    let Some(record) = read_json::<SandboxRecord>(&sandbox_record_path(token))? else {
+        return Ok(None);
+    };
+    check_schema(record.schema_version, "sandbox")?;
+    Ok(Some(record))
+}
+
+/// Read the global daemon record, validating its schema. Returns `Ok(None)` if
+/// the record does not exist. A present record does **not** imply the daemon is
+/// alive — pair with [`daemon_alive`].
+pub fn read_daemon_record() -> Result<Option<DaemonRecord>> {
+    let Some(record) = read_json::<DaemonRecord>(&daemon_record_path())? else {
+        return Ok(None);
+    };
+    check_schema(record.schema_version, "daemon")?;
+    Ok(Some(record))
+}
+
+/// Read the daemon record only if it describes a process that is still alive.
+/// A present-but-dead record (daemon crashed without cleanup) yields `None`.
+pub fn live_daemon() -> Result<Option<DaemonRecord>> {
+    match read_daemon_record()? {
+        Some(record) if daemon_alive(&record) => Ok(Some(record)),
+        _ => Ok(None),
+    }
+}
+
+// Record helpers retain the atomic-write and owner-only-DACL contract.
+
+/// Atomically write the global daemon record.
+pub fn write_daemon_record(record: &DaemonRecord) -> Result<()> {
+    atomic_write_json(&daemon_record_path(), record)
+}
+
+/// Remove the global daemon record, treating `NotFound` as success.
+pub fn remove_daemon_record() -> std::io::Result<()> {
+    match std::fs::remove_file(daemon_record_path()) {
+        Ok(()) => Ok(()),
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        Err(e) => Err(e),
+    }
+}
+
+/// Atomically write the per-sandbox `record` for `token` to disk.
+pub fn write_sandbox_record(token: &str, record: &SandboxRecord) -> Result<()> {
+    atomic_write_json(&sandbox_record_path(token), record)
+}
+
+/// Remove the per-sandbox directory, treating `NotFound` as success.
+pub fn remove_sandbox_dir(token: &str) -> std::io::Result<()> {
+    match std::fs::remove_dir_all(sandbox_dir(token)) {
+        Ok(()) => Ok(()),
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        Err(e) => Err(e),
+    }
+}
+
+// Daemon line protocol on `127.0.0.1:<ipc_port>`:
+//   request  : `<VERB> <nonce>\n`
+//   response : `OK\n` | `PONG\n` | `ERR <message>\n`
+// `EXEC` continues into a binary frame stream after its status line.
+
+/// Liveness/echo verb. Response: `PONG`.
+pub const IPC_PING: &str = "PING";
+/// Teardown verb: the daemon tears down its VM and exits. Response: `OK`.
+pub const IPC_STOP: &str = "STOP";
+/// Exec verb: after `EXEC <nonce>\n` the client sends a framed `ExecStart`
+/// request and the daemon replies with a status line then a binary frame
+/// stream (see [`crate::ipc_exec`]). Admission response: `OK` or `ERR <msg>`.
+pub const IPC_EXEC: &str = "EXEC";
+/// Success response token.
+pub const IPC_OK: &str = "OK";
+/// Ping success response token.
+pub const IPC_PONG: &str = "PONG";
+/// Error response prefix (`ERR <message>`).
+pub const IPC_ERR: &str = "ERR";
+/// Exec-admission reason token: another exec already holds the single-flight
+/// guest slot. Emitted by the daemon as `ERR busy`, matched by the client.
+pub const IPC_ERR_BUSY: &str = "busy";
+/// Exec-admission reason token: the guest slot exists but is still booting.
+/// Emitted by the daemon as `ERR not ready`, matched by the client.
+pub const IPC_ERR_NOT_READY: &str = "not ready";
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn paths_are_nested_under_root() {
+        let root = state_aware_root();
+        assert!(root.ends_with("state-aware"));
+        assert_eq!(sandbox_dir("abc"), root.join("abc"));
+        assert_eq!(
+            sandbox_record_path("abc"),
+            root.join("abc").join("record.json")
+        );
+        assert_eq!(daemon_record_path(), root.join("daemon.json"));
+    }
+
+    #[test]
+    fn sandbox_record_roundtrips() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("record.json");
+        let rec = SandboxRecord::new_provisioned(
+            "wsb:deadbeef".to_string(),
+            vec![MappedFolderRecord {
+                host: r"C:\work".to_string(),
+                sandbox: r"C:\work".to_string(),
+                read_only: false,
+            }],
+        );
+        atomic_write_json(&path, &rec).unwrap();
+        let back: SandboxRecord = read_json(&path).unwrap().unwrap();
+        assert_eq!(back, rec);
+        assert_eq!(back.state, SandboxState::Provisioned);
+    }
+
+    #[test]
+    fn daemon_record_roundtrips() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("daemon.json");
+        let rec = DaemonRecord {
+            schema_version: RECORD_SCHEMA_VERSION,
+            pid: 1234,
+            pid_creation_time: 42,
+            ipc_port: 49500,
+            nonce: "abc123".to_string(),
+            active_sandbox_id: "wsb:deadbeef".to_string(),
+            ready: true,
+            vm_processes: vec![VmProcId {
+                pid: 5678,
+                creation_time: 99,
+            }],
+        };
+        atomic_write_json(&path, &rec).unwrap();
+        let back: DaemonRecord = read_json(&path).unwrap().unwrap();
+        assert_eq!(back, rec);
+    }
+
+    #[test]
+    fn read_json_missing_is_none() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("nope.json");
+        let back: Option<SandboxRecord> = read_json(&path).unwrap();
+        assert!(back.is_none());
+    }
+
+    #[test]
+    fn atomic_write_overwrites_existing() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("record.json");
+        let mut rec = SandboxRecord::new_provisioned("wsb:x".to_string(), Vec::new());
+        atomic_write_json(&path, &rec).unwrap();
+        rec.state = SandboxState::Started;
+        atomic_write_json(&path, &rec).unwrap();
+        let back: SandboxRecord = read_json(&path).unwrap().unwrap();
+        assert_eq!(back.state, SandboxState::Started);
+        // No stray temp files left behind.
+        let leftovers: Vec<_> = std::fs::read_dir(dir.path())
+            .unwrap()
+            .filter_map(|e| e.ok())
+            .filter(|e| e.file_name().to_string_lossy().ends_with(".tmp"))
+            .collect();
+        assert!(leftovers.is_empty(), "temp files leaked: {:?}", leftovers);
+    }
+
+    #[test]
+    fn check_schema_rejects_mismatch() {
+        assert!(check_schema(RECORD_SCHEMA_VERSION, "sandbox").is_ok());
+        assert!(check_schema(RECORD_SCHEMA_VERSION + 1, "sandbox").is_err());
+    }
+
+    fn daemon_record_with(vm_processes: Vec<VmProcId>) -> DaemonRecord {
+        DaemonRecord {
+            schema_version: RECORD_SCHEMA_VERSION,
+            pid: 1,
+            pid_creation_time: 1,
+            ipc_port: 1,
+            nonce: "n".to_string(),
+            active_sandbox_id: "wsb:x".to_string(),
+            ready: true,
+            vm_processes,
+        }
+    }
+
+    #[test]
+    fn classify_no_vm_proceeds() {
+        let prior = daemon_record_with(vec![VmProcId {
+            pid: 10,
+            creation_time: 100,
+        }]);
+        assert_eq!(classify_startup(Some(&prior), &[]), StartupAction::Proceed);
+        assert_eq!(classify_startup(None, &[]), StartupAction::Proceed);
+    }
+
+    #[test]
+    fn classify_vm_no_prior_refuses() {
+        let current = [VmProcId {
+            pid: 10,
+            creation_time: 100,
+        }];
+        assert_eq!(
+            classify_startup(None, &current),
+            StartupAction::RefuseForeign
+        );
+    }
+
+    #[test]
+    fn classify_vm_empty_prior_processes_refuses() {
+        let prior = daemon_record_with(Vec::new());
+        let current = [VmProcId {
+            pid: 10,
+            creation_time: 100,
+        }];
+        assert_eq!(
+            classify_startup(Some(&prior), &current),
+            StartupAction::RefuseForeign
+        );
+    }
+
+    #[test]
+    fn classify_disjoint_set_refuses() {
+        let prior = daemon_record_with(vec![VmProcId {
+            pid: 10,
+            creation_time: 100,
+        }]);
+        // Same pid but different creation time must NOT match (PID reuse).
+        let current = [VmProcId {
+            pid: 10,
+            creation_time: 999,
+        }];
+        assert_eq!(
+            classify_startup(Some(&prior), &current),
+            StartupAction::RefuseForeign
+        );
+    }
+
+    #[test]
+    fn classify_intersecting_set_reclaims() {
+        let shared = VmProcId {
+            pid: 10,
+            creation_time: 100,
+        };
+        let other_prior = VmProcId {
+            pid: 11,
+            creation_time: 101,
+        };
+        let prior = daemon_record_with(vec![shared, other_prior]);
+        // current has one process not in prior plus the shared one.
+        let current = [
+            VmProcId {
+                pid: 20,
+                creation_time: 200,
+            },
+            shared,
+        ];
+        // Reclaim returns the PRIOR proof (used to seed plan_kill_set), not
+        // the live snapshot. Seeding with the snapshot would promote any
+        // foreign WindowsSandbox* process observed at startup into "proof".
+        assert_eq!(
+            classify_startup(Some(&prior), &current),
+            StartupAction::ReclaimOrphan {
+                proof: vec![shared, other_prior]
+            }
+        );
+    }
+
+    // ----- plan_kill_set: pure kill planner --------------------------------
+
+    fn pid(p: u32, ct: u64) -> VmProcId {
+        VmProcId {
+            pid: p,
+            creation_time: ct,
+        }
+    }
+
+    #[test]
+    fn plan_kill_set_not_launched_is_none_regardless_of_snapshot() {
+        assert_eq!(plan_kill_set(&VmOwnership::NotLaunched, &[]), None);
+        assert_eq!(
+            plan_kill_set(&VmOwnership::NotLaunched, &[pid(1, 1), pid(2, 2)]),
+            None
+        );
+    }
+
+    #[test]
+    fn plan_kill_set_launch_in_flight_is_none_regardless_of_snapshot() {
+        // Critical safety property: an in-flight launch is ambiguous (a
+        // foreign VM could have won the contest) so we must never kill
+        // anything, even if WindowsSandbox* processes are visible.
+        assert_eq!(plan_kill_set(&VmOwnership::LaunchInFlight, &[]), None);
+        assert_eq!(
+            plan_kill_set(&VmOwnership::LaunchInFlight, &[pid(1, 1)]),
+            None
+        );
+    }
+
+    #[test]
+    fn plan_kill_set_owned_with_empty_snapshot_returns_proof() {
+        // The recorded proof may be dead PIDs but `terminate_processes`
+        // checks creation_time, so killing already-dead identities is a no-op.
+        // Critically we DO NOT enumerate-kill on empty snapshot in `Owned`.
+        let proof = vec![pid(10, 100), pid(11, 101)];
+        assert_eq!(
+            plan_kill_set(&VmOwnership::Owned(proof.clone()), &[]),
+            Some(proof)
+        );
+    }
+
+    #[test]
+    fn plan_kill_set_owned_intersect_unions_proof_and_snapshot() {
+        let shared = pid(10, 100);
+        let proof_only = pid(11, 101);
+        let snapshot_only = pid(20, 200);
+        let proof = vec![shared, proof_only];
+        let snapshot = vec![snapshot_only, shared];
+        let kill = plan_kill_set(&VmOwnership::Owned(proof), &snapshot).unwrap();
+        // Order: proof first, snapshot extras appended.
+        assert_eq!(kill, vec![shared, proof_only, snapshot_only]);
+    }
+
+    #[test]
+    fn plan_kill_set_owned_disjoint_returns_only_proof() {
+        // The live VM is NOT ours; never enumerate-kill foreign. We still
+        // return the recorded proof so any of our still-alive recorded
+        // processes get cleaned up, but PID+creation_time matching makes a
+        // dead-recorded-PID kill a safe no-op.
+        let proof = vec![pid(10, 100)];
+        let foreign = vec![pid(99, 999)];
+        assert_eq!(
+            plan_kill_set(&VmOwnership::Owned(proof.clone()), &foreign),
+            Some(proof)
+        );
+    }
+
+    #[test]
+    fn plan_kill_set_owned_pid_match_but_different_creation_time_is_disjoint() {
+        // PID reuse defence: same PID, different creation_time is NOT a
+        // match. Must return only the recorded proof, never the snapshot's
+        // recycled-PID identity.
+        let proof = vec![pid(10, 100)];
+        let snapshot = vec![pid(10, 999)];
+        assert_eq!(
+            plan_kill_set(&VmOwnership::Owned(proof.clone()), &snapshot),
+            Some(proof)
+        );
+    }
+
+    #[test]
+    fn plan_kill_set_launch_succeeded_no_proof_empty_snapshot_is_none() {
+        // No proof and no live VM: nothing to kill. The narrow
+        // "VM never produced visible processes" wedge is accepted here.
+        assert_eq!(
+            plan_kill_set(&VmOwnership::LaunchSucceededNoProof, &[]),
+            None
+        );
+    }
+
+    #[test]
+    fn plan_kill_set_launch_succeeded_no_proof_with_snapshot_enumerates() {
+        // The caller reaches this state only on a launch() Ok while holding
+        // the host VM-slot mutex; by single-instance + the mutex the snapshot
+        // is ours. This is the empty-proof recovery path: an intersection-only
+        // kill would miss it because there is no proof to intersect.
+        let snapshot = vec![pid(10, 100), pid(11, 101)];
+        assert_eq!(
+            plan_kill_set(&VmOwnership::LaunchSucceededNoProof, &snapshot),
+            Some(snapshot)
+        );
+    }
+
+    // ----- classify_stale_daemon_cleanup -----------------------------------
+
+    fn stale_with(active: &str, vm_processes: Vec<VmProcId>) -> DaemonRecord {
+        DaemonRecord {
+            schema_version: RECORD_SCHEMA_VERSION,
+            pid: 1,
+            pid_creation_time: 1,
+            ipc_port: 1,
+            nonce: "n".to_string(),
+            active_sandbox_id: active.to_string(),
+            ready: true,
+            vm_processes,
+        }
+    }
+
+    #[test]
+    fn stale_cleanup_no_stale_record_no_live_is_no_live_vm() {
+        assert_eq!(
+            classify_stale_daemon_cleanup(None, "wsb:x", Some(&[])),
+            StaleDaemonCleanup::NoLiveVm
+        );
+    }
+
+    #[test]
+    fn stale_cleanup_probe_failed_refuses() {
+        assert_eq!(
+            classify_stale_daemon_cleanup(None, "wsb:x", None),
+            StaleDaemonCleanup::RefuseProbeFailed
+        );
+        // Probe-failed wins even when a stale record exists.
+        let stale = stale_with("wsb:x", vec![pid(10, 100)]);
+        assert_eq!(
+            classify_stale_daemon_cleanup(Some(&stale), "wsb:x", None),
+            StaleDaemonCleanup::RefuseProbeFailed
+        );
+    }
+
+    #[test]
+    fn stale_cleanup_sandbox_id_mismatch_refuses_before_anything_else() {
+        // Even with an intersecting live VM, a mismatched stale record must
+        // refuse: cleanup of sandbox A must NEVER reclaim sandbox B's orphan.
+        let stale = stale_with("wsb:b", vec![pid(10, 100)]);
+        let live = vec![pid(10, 100)];
+        assert_eq!(
+            classify_stale_daemon_cleanup(Some(&stale), "wsb:a", Some(&live)),
+            StaleDaemonCleanup::RefuseSandboxIdMismatch {
+                stale_active: "wsb:b".to_string()
+            }
+        );
+        // Mismatch even fires on an empty live set so the operator gets a
+        // clear diagnostic (the alternative is "looks fine, advance state"
+        // which silently corrupts cross-sandbox bookkeeping).
+        assert_eq!(
+            classify_stale_daemon_cleanup(Some(&stale), "wsb:a", Some(&[])),
+            StaleDaemonCleanup::RefuseSandboxIdMismatch {
+                stale_active: "wsb:b".to_string()
+            }
+        );
+    }
+
+    #[test]
+    fn stale_cleanup_matching_record_empty_live_is_no_live_vm() {
+        let stale = stale_with("wsb:x", vec![pid(10, 100)]);
+        assert_eq!(
+            classify_stale_daemon_cleanup(Some(&stale), "wsb:x", Some(&[])),
+            StaleDaemonCleanup::NoLiveVm
+        );
+    }
+
+    #[test]
+    fn stale_cleanup_intersection_reclaims_with_prior_proof() {
+        let shared = pid(10, 100);
+        let proof = vec![shared, pid(11, 101)];
+        let stale = stale_with("wsb:x", proof.clone());
+        let live = vec![shared, pid(20, 200)];
+        assert_eq!(
+            classify_stale_daemon_cleanup(Some(&stale), "wsb:x", Some(&live)),
+            StaleDaemonCleanup::Reclaim { proof }
+        );
+    }
+
+    #[test]
+    fn stale_cleanup_empty_stale_proof_with_live_refuses_foreign() {
+        // The empty-proof wedge surface in stop/deprovision: a daemon died before
+        // capture_launch_proof populated vm_processes; a live VM exists but
+        // we have no positive proof it is ours. RefuseForeign (no sole-claim
+        // weakening of the positive-proof invariant).
+        let stale = stale_with("wsb:x", Vec::new());
+        let live = vec![pid(10, 100)];
+        assert_eq!(
+            classify_stale_daemon_cleanup(Some(&stale), "wsb:x", Some(&live)),
+            StaleDaemonCleanup::RefuseForeign { live }
+        );
+    }
+
+    #[test]
+    fn stale_cleanup_disjoint_live_refuses_foreign() {
+        let stale = stale_with("wsb:x", vec![pid(10, 100)]);
+        let live = vec![pid(20, 200)];
+        assert_eq!(
+            classify_stale_daemon_cleanup(Some(&stale), "wsb:x", Some(&live)),
+            StaleDaemonCleanup::RefuseForeign { live }
+        );
+    }
+
+    #[test]
+    fn stale_cleanup_pid_match_creation_time_diff_refuses() {
+        // PID reuse defence at the stop/deprovision orphan-cleanup site.
+        let stale = stale_with("wsb:x", vec![pid(10, 100)]);
+        let live = vec![pid(10, 999)];
+        assert_eq!(
+            classify_stale_daemon_cleanup(Some(&stale), "wsb:x", Some(&live)),
+            StaleDaemonCleanup::RefuseForeign { live }
+        );
+    }
+
+    #[test]
+    fn stale_cleanup_no_stale_record_with_live_refuses_foreign() {
+        // No record at all but a live VM: definitely not ours.
+        let live = vec![pid(10, 100)];
+        assert_eq!(
+            classify_stale_daemon_cleanup(None, "wsb:x", Some(&live)),
+            StaleDaemonCleanup::RefuseForeign { live }
+        );
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn current_process_is_alive_with_matching_creation_time() {
+        let pid = std::process::id();
+        let ct = process_creation_time(pid).expect("current process should have a creation time");
+        let rec = DaemonRecord {
+            schema_version: RECORD_SCHEMA_VERSION,
+            pid,
+            pid_creation_time: ct,
+            ipc_port: 1,
+            nonce: "n".to_string(),
+            active_sandbox_id: "wsb:x".to_string(),
+            ready: true,
+            vm_processes: Vec::new(),
+        };
+        assert!(daemon_alive(&rec));
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn wrong_creation_time_is_not_alive() {
+        let pid = std::process::id();
+        let ct = process_creation_time(pid).unwrap();
+        let rec = DaemonRecord {
+            schema_version: RECORD_SCHEMA_VERSION,
+            pid,
+            pid_creation_time: ct ^ 0xFFFF,
+            ipc_port: 1,
+            nonce: "n".to_string(),
+            active_sandbox_id: "wsb:x".to_string(),
+            ready: true,
+            vm_processes: Vec::new(),
+        };
+        assert!(!daemon_alive(&rec));
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn dead_pid_has_no_creation_time() {
+        // PID 0 is never a queryable user process.
+        assert_eq!(process_creation_time(0), None);
+        assert_eq!(running_process_creation_time(0), None);
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn running_creation_time_matches_plain_for_live_self() {
+        let pid = std::process::id();
+        assert_eq!(
+            running_process_creation_time(pid),
+            process_creation_time(pid)
+        );
+        assert!(running_process_creation_time(pid).is_some());
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn running_creation_time_excludes_terminated_but_handle_retained() {
+        use std::process::{Command, Stdio};
+        // A long-lived child we control. `std::process::Child` retains the
+        // process handle until `wait()`, so after we kill it the kernel object
+        // lingers and `OpenProcess`-by-PID still resolves it — exactly the
+        // "crashed launcher whose parent kept a handle" case that wedged
+        // reclaim.
+        let mut child = Command::new("cmd")
+            .args(["/C", "ping -n 999 127.0.0.1"])
+            .stdin(Stdio::null())
+            .stdout(Stdio::null())
+            .stderr(Stdio::null())
+            .spawn()
+            .expect("spawn child");
+        let pid = child.id();
+
+        // While alive both probes agree.
+        let ct = process_creation_time(pid).expect("live child has a creation time");
+        assert_eq!(running_process_creation_time(pid), Some(ct));
+
+        // Terminate but DELIBERATELY do not `wait()`: `child` keeps the handle.
+        child.kill().expect("kill child");
+        // The process handle becomes signalled shortly after termination.
+        for _ in 0..100 {
+            if running_process_creation_time(pid).is_none() {
+                break;
+            }
+            std::thread::sleep(std::time::Duration::from_millis(20));
+        }
+
+        // The lingering terminated object still resolves a creation time via the
+        // plain probe...
+        assert_eq!(
+            process_creation_time(pid),
+            Some(ct),
+            "terminated-but-handle-retained object should still resolve a creation time"
+        );
+        // ...but the liveness-aware probe correctly reports it as gone.
+        assert_eq!(
+            running_process_creation_time(pid),
+            None,
+            "a terminated process must not be reported as running"
+        );
+
+        let _ = child.wait();
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn enumerate_finds_current_process_by_image_prefix() {
+        // The test runner's own image name is a stable, present process. Use a
+        // short prefix of its file stem and assert the Toolhelp32 snapshot finds
+        // our PID with a matching creation time.
+        let exe = std::env::current_exe().unwrap();
+        let stem = exe.file_stem().unwrap().to_string_lossy().into_owned();
+        let prefix: String = stem.chars().take(6).collect();
+
+        let pids = enumerate_pids_with_prefix(&prefix).unwrap();
+        assert!(
+            pids.contains(&std::process::id()),
+            "expected snapshot for prefix {prefix:?} to contain our pid {}, got {pids:?}",
+            std::process::id()
+        );
+
+        let procs = enumerate_processes_with_prefix(&prefix).unwrap();
+        let ours = procs
+            .iter()
+            .find(|p| p.pid == std::process::id())
+            .expect("our process should be enumerated with an identity");
+        assert_eq!(ours.creation_time, process_creation_time(ours.pid).unwrap());
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn enumerate_unmatched_prefix_is_empty() {
+        let pids = enumerate_pids_with_prefix("zzz_no_such_process_prefix_zzz").unwrap();
+        assert!(pids.is_empty(), "unexpected matches: {pids:?}");
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn transition_lock_acquire_release_reacquire() {
+        use std::time::Duration;
+        {
+            let _lock = TransitionLock::acquire(Duration::from_secs(5)).unwrap();
+        }
+        // Dropped above; a second acquire must succeed promptly.
+        let _lock2 = TransitionLock::acquire(Duration::from_secs(5)).unwrap();
+    }
+
+    #[test]
+    fn decide_cleanup_not_launched_is_noop() {
+        assert_eq!(
+            decide_cleanup(&VmOwnership::NotLaunched),
+            CleanupAction::Noop
+        );
+    }
+
+    #[test]
+    fn decide_cleanup_launch_in_flight_leaks() {
+        // Critical safety property: an in-flight (unproven) launch must NEVER
+        // tear anything down (a foreign VM may have won the contest).
+        assert_eq!(
+            decide_cleanup(&VmOwnership::LaunchInFlight),
+            CleanupAction::LeakUnowned
+        );
+    }
+
+    #[test]
+    fn decide_cleanup_launch_succeeded_no_proof_tears_down_by_enumeration() {
+        // launch() returned Ok -> the VM is ours; tear it down even without
+        // recorded proof, via an empty seed that teardown_owned enumerates.
+        assert_eq!(
+            decide_cleanup(&VmOwnership::LaunchSucceededNoProof),
+            CleanupAction::Teardown(Vec::new())
+        );
+    }
+
+    #[test]
+    fn decide_cleanup_owned_tears_down_recorded() {
+        let pids = vec![
+            VmProcId {
+                pid: 10,
+                creation_time: 100,
+            },
+            VmProcId {
+                pid: 20,
+                creation_time: 200,
+            },
+        ];
+        assert_eq!(
+            decide_cleanup(&VmOwnership::Owned(pids.clone())),
+            CleanupAction::Teardown(pids)
+        );
+    }
+
+    #[test]
+    fn terminate_empty_targets_kills_nothing() {
+        assert_eq!(terminate_processes(&[]), 0);
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn terminate_kills_recorded_process() {
+        let mut child = std::process::Command::new("cmd.exe")
+            .args(["/c", "pause"])
+            .stdin(std::process::Stdio::null())
+            .stdout(std::process::Stdio::null())
+            .stderr(std::process::Stdio::null())
+            .spawn()
+            .unwrap();
+        let pid = child.id();
+        let creation_time = process_creation_time(pid).expect("creation time");
+        let killed = terminate_processes(&[VmProcId { pid, creation_time }]);
+        assert_eq!(killed, 1);
+        // `terminate_processes` only requests termination; the test reaps the child.
+        let status = child.wait().unwrap();
+        assert!(!status.success());
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn terminate_skips_creation_time_mismatch() {
+        // Spawn a child, but record a deliberately-wrong creation time so the
+        // PID-reuse guard refuses to kill it.
+        let mut child = std::process::Command::new("cmd.exe")
+            .args(["/c", "pause"])
+            .stdin(std::process::Stdio::null())
+            .stdout(std::process::Stdio::null())
+            .stderr(std::process::Stdio::null())
+            .spawn()
+            .unwrap();
+        let pid = child.id();
+        let real = process_creation_time(pid).expect("creation time");
+        let wrong = real.wrapping_add(1);
+        let killed = terminate_processes(&[VmProcId {
+            pid,
+            creation_time: wrong,
+        }]);
+        assert_eq!(killed, 0, "must not kill a PID whose creation time differs");
+        // The child is still alive; clean it up directly.
+        let _ = child.kill();
+        let _ = child.wait();
+    }
+
+    /// Ensure atomic writes protect the parent before creating the temp file.
+    #[cfg(windows)]
+    #[test]
+    fn atomic_write_protects_parent_directory() {
+        use std::os::windows::ffi::OsStrExt;
+        use windows::core::PCWSTR;
+        use windows::Win32::Foundation::{LocalFree, ERROR_SUCCESS, HLOCAL};
+        use windows::Win32::Security::Authorization::{GetNamedSecurityInfoW, SE_FILE_OBJECT};
+        use windows::Win32::Security::{
+            GetSecurityDescriptorControl, DACL_SECURITY_INFORMATION, PSECURITY_DESCRIPTOR,
+            SE_DACL_PROTECTED,
+        };
+
+        let dir = tempfile::tempdir().unwrap();
+        // A nested parent that `atomic_write_json` must create + secure itself,
+        // so it cannot accidentally pass by inheriting a protected tempdir.
+        let parent = dir.path().join("nested");
+        let path = parent.join("daemon.json");
+        let rec = daemon_record_with(vec![VmProcId {
+            pid: 5,
+            creation_time: 7,
+        }]);
+        atomic_write_json(&path, &rec).unwrap();
+
+        let mut wide: Vec<u16> = parent.as_os_str().encode_wide().collect();
+        wide.push(0);
+        let mut sd = PSECURITY_DESCRIPTOR::default();
+        let rc = unsafe {
+            GetNamedSecurityInfoW(
+                PCWSTR(wide.as_ptr()),
+                SE_FILE_OBJECT,
+                DACL_SECURITY_INFORMATION,
+                None,
+                None,
+                None,
+                None,
+                &mut sd,
+            )
+        };
+        assert_eq!(rc, ERROR_SUCCESS, "GetNamedSecurityInfoW failed: {rc:?}");
+
+        let mut control = 0u16;
+        let mut revision = 0u32;
+        let got = unsafe { GetSecurityDescriptorControl(sd, &mut control, &mut revision) };
+        let protected = (control & SE_DACL_PROTECTED.0) != 0;
+        unsafe {
+            let _ = LocalFree(Some(HLOCAL(sd.0)));
+        }
+        got.expect("GetSecurityDescriptorControl");
+        assert!(
+            protected,
+            "record parent dir must have a PROTECTED DACL (got control bits {control:#06x})"
+        );
+    }
+}
diff --git a/src/backends/windows_sandbox/lifecycle/src/control_plane/os.rs b/src/backends/windows_sandbox/lifecycle/src/control_plane/os.rs
new file mode 100644
index 000000000..06b105711
--- /dev/null
+++ b/src/backends/windows_sandbox/lifecycle/src/control_plane/os.rs
@@ -0,0 +1,420 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Win32 DACL, process, and named-mutex primitives for the control plane.
+
+use std::path::Path;
+
+use anyhow::{Context, Result};
+
+use super::VmProcId;
+
+/// Per-session transition mutex. Same-user denial of service is within the
+/// backend's trust boundary.
+const TRANSITION_MUTEX_NAME: &str = r"Local\wxc-wsb-stateaware-transition";
+
+/// Per-session mutex for the host's single Windows Sandbox VM slot.
+///
+/// One-shot and state-aware owners hold it for the VM lifetime so neither can
+/// tear down the other's VM. `Global\` is unsuitable because these unelevated
+/// processes lack `SeCreateGlobalPrivilege`; cross-session use is unsupported.
+pub const HOST_VM_MUTEX_NAME: &str = r"Local\wxc-wsb-vm";
+
+// ---------------------------------------------------------------------------
+// Filesystem DACL helpers
+// ---------------------------------------------------------------------------
+
+/// Apply an inheritable owner-only DACL and reject directories owned by another
+/// user, who would retain implicit `WRITE_DAC`.
+#[cfg(windows)]
+pub fn set_owner_only_dir(dir: &Path) -> Result<()> {
+    wxc_common::filesystem_dacl::set_owner_only_dacl(dir, true)
+        .map_err(|e| anyhow::Error::new(e).context(format!("secure dir {dir:?}")))?;
+    // A foreign owner could use implicit WRITE_DAC to defeat the new ACL.
+    let owned = wxc_common::filesystem_dacl::owner_is_self(dir)
+        .map_err(|e| anyhow::Error::new(e).context(format!("read owner of {dir:?}")))?;
+    if !owned {
+        anyhow::bail!(
+            "refusing to use {dir:?}: it is owned by another user (cross-user tampering risk on \
+             a shared temp directory). Remove it and retry."
+        );
+    }
+    Ok(())
+}
+
+/// Non-Windows no-op.
+#[cfg(not(windows))]
+pub fn set_owner_only_dir(_dir: &Path) -> Result<()> {
+    Ok(())
+}
+
+/// Create and secure a directory before reading trusted state from it.
+#[cfg(windows)]
+pub fn ensure_secure_dir(dir: &Path) -> Result<()> {
+    std::fs::create_dir_all(dir).with_context(|| format!("create dir {dir:?}"))?;
+    set_owner_only_dir(dir)
+}
+
+/// Non-Windows directory creation.
+#[cfg(not(windows))]
+pub fn ensure_secure_dir(dir: &Path) -> Result<()> {
+    std::fs::create_dir_all(dir).with_context(|| format!("create dir {dir:?}"))
+}
+
+/// Apply an owner-only DACL to an existing file.
+#[cfg(windows)]
+pub(crate) fn set_owner_only_file(path: &Path) -> Result<()> {
+    wxc_common::filesystem_dacl::set_owner_only_dacl(path, false)
+        .map_err(|e| anyhow::Error::new(e).context(format!("secure file {path:?}")))
+}
+
+#[cfg(not(windows))]
+pub(crate) fn set_owner_only_file(_path: &Path) -> Result<()> {
+    Ok(())
+}
+
+// ---------------------------------------------------------------------------
+// PID-reuse-safe liveness
+// ---------------------------------------------------------------------------
+
+/// Return the creation time (Win32 `FILETIME`, 100ns ticks since 1601) of the
+/// process with `pid`, or `None` if it does not exist / cannot be queried.
+///
+/// The creation time pins a PID to a specific process instance: a recycled PID
+/// gets a new creation time, so comparing it defeats PID reuse.
+#[cfg(windows)]
+pub fn process_creation_time(pid: u32) -> Option<u64> {
+    use windows::Win32::Foundation::{CloseHandle, FILETIME};
+    use windows::Win32::System::Threading::{
+        GetProcessTimes, OpenProcess, PROCESS_QUERY_LIMITED_INFORMATION,
+    };
+
+    if pid == 0 {
+        return None;
+    }
+    // SAFETY: `pid` is a plain integer; the handle is closed on every path and
+    // the FILETIME out-params are fully initialised before use.
+    unsafe {
+        let handle = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, false, pid).ok()?;
+        let mut creation = FILETIME::default();
+        let mut exit = FILETIME::default();
+        let mut kernel = FILETIME::default();
+        let mut user = FILETIME::default();
+        let ok = GetProcessTimes(handle, &mut creation, &mut exit, &mut kernel, &mut user).is_ok();
+        let _ = CloseHandle(handle);
+        if !ok {
+            return None;
+        }
+        Some(((creation.dwHighDateTime as u64) << 32) | creation.dwLowDateTime as u64)
+    }
+}
+
+#[cfg(not(windows))]
+pub fn process_creation_time(_pid: u32) -> Option<u64> {
+    None
+}
+
+/// Creation time of `pid` only while the process is still running.
+///
+/// A retained handle keeps an exited process queryable, so this also checks the
+/// handle's signalled state.
+#[cfg(windows)]
+pub fn running_process_creation_time(pid: u32) -> Option<u64> {
+    use windows::Win32::Foundation::{CloseHandle, FILETIME, WAIT_OBJECT_0};
+    use windows::Win32::System::Threading::{
+        GetProcessTimes, OpenProcess, WaitForSingleObject, PROCESS_QUERY_LIMITED_INFORMATION,
+        PROCESS_SYNCHRONIZE,
+    };
+
+    if pid == 0 {
+        return None;
+    }
+    // SAFETY: `pid` is a plain integer; the handle is closed on every path and
+    // the FILETIME out-params are fully initialised before use.
+    unsafe {
+        let handle = OpenProcess(
+            PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_SYNCHRONIZE,
+            false,
+            pid,
+        )
+        .ok()?;
+        // Process handles become signalled on exit.
+        let exited = WaitForSingleObject(handle, 0) == WAIT_OBJECT_0;
+        let mut creation = FILETIME::default();
+        let mut exit = FILETIME::default();
+        let mut kernel = FILETIME::default();
+        let mut user = FILETIME::default();
+        let ok = GetProcessTimes(handle, &mut creation, &mut exit, &mut kernel, &mut user).is_ok();
+        let _ = CloseHandle(handle);
+        if !ok || exited {
+            return None;
+        }
+        Some(((creation.dwHighDateTime as u64) << 32) | creation.dwLowDateTime as u64)
+    }
+}
+
+#[cfg(not(windows))]
+pub fn running_process_creation_time(_pid: u32) -> Option<u64> {
+    None
+}
+
+// ---------------------------------------------------------------------------
+// Scoped image-prefix process enumeration / termination
+// ---------------------------------------------------------------------------
+
+/// Enumerate the PIDs of all running processes whose image name starts
+/// (case-insensitively) with `name_prefix`, via a single Toolhelp32 snapshot.
+///
+/// Fast, with no external dependency, and takes one atomic snapshot of the
+/// process list — the right substrate for ownership-proof and liveness
+/// decisions. Returns
+/// `Err` only if the snapshot itself could not be taken, so callers gating a
+/// destructive decision can treat `Err` as "unknown" and fail safe.
+#[cfg(windows)]
+pub fn enumerate_pids_with_prefix(name_prefix: &str) -> Result<Vec<u32>> {
+    use windows::Win32::Foundation::CloseHandle;
+    use windows::Win32::System::Diagnostics::ToolHelp::{
+        CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, PROCESSENTRY32W,
+        TH32CS_SNAPPROCESS,
+    };
+
+    fn wide_to_string(wide: &[u16]) -> String {
+        let len = wide.iter().position(|&c| c == 0).unwrap_or(wide.len());
+        String::from_utf16_lossy(&wide[..len])
+    }
+
+    let prefix_lower = name_prefix.to_lowercase();
+    let mut pids = Vec::new();
+
+    // SAFETY: the snapshot handle is closed on every return path; the
+    // PROCESSENTRY32W is fully initialised (dwSize set) before the first/next
+    // calls, and the szExeFile out-param is a fixed-size array.
+    unsafe {
+        let snapshot =
+            CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0).context("CreateToolhelp32Snapshot")?;
+
+        let mut entry = PROCESSENTRY32W {
+            dwSize: std::mem::size_of::<PROCESSENTRY32W>() as u32,
+            ..Default::default()
+        };
+
+        let mut ok = Process32FirstW(snapshot, &mut entry).is_ok();
+        while ok {
+            let name = wide_to_string(&entry.szExeFile);
+            if name.to_lowercase().starts_with(&prefix_lower) {
+                pids.push(entry.th32ProcessID);
+            }
+            ok = Process32NextW(snapshot, &mut entry).is_ok();
+        }
+
+        let _ = CloseHandle(snapshot);
+    }
+
+    Ok(pids)
+}
+
+#[cfg(not(windows))]
+pub fn enumerate_pids_with_prefix(_name_prefix: &str) -> Result<Vec<u32>> {
+    Ok(Vec::new())
+}
+
+/// Enumerate the identities (PID + creation time) of all running processes
+/// whose image name starts (case-insensitively) with `name_prefix`.
+///
+/// Built on [`enumerate_pids_with_prefix`] for the snapshot, then pairs each
+/// PID with its creation time so the result is PID-reuse-safe. A process that
+/// exits between the snapshot and the creation-time query is simply dropped.
+pub fn enumerate_processes_with_prefix(name_prefix: &str) -> Result<Vec<VmProcId>> {
+    let mut procs = Vec::new();
+    for pid in enumerate_pids_with_prefix(name_prefix)? {
+        if let Some(creation_time) = process_creation_time(pid) {
+            procs.push(VmProcId { pid, creation_time });
+        }
+    }
+    Ok(procs)
+}
+
+/// Terminate exactly the processes in `targets`, verifying each one's live
+/// creation time still matches before killing so a recycled PID is never hit.
+/// Returns the number of processes actually terminated.
+///
+/// This never enumerates or kills by image name — it can only touch processes
+/// explicitly recorded as ours — so it cannot disturb a VM this host did not
+/// launch. It is the scoped replacement for `taskkill /F /IM WindowsSandbox*`.
+#[cfg(windows)]
+pub fn terminate_processes(targets: &[VmProcId]) -> usize {
+    use windows::Win32::Foundation::{CloseHandle, FILETIME};
+    use windows::Win32::System::Threading::{
+        GetProcessTimes, OpenProcess, TerminateProcess, PROCESS_QUERY_LIMITED_INFORMATION,
+        PROCESS_TERMINATE,
+    };
+
+    let mut killed = 0usize;
+    for target in targets {
+        if target.pid == 0 {
+            continue;
+        }
+        // SAFETY: `pid` is a plain integer; the handle is closed on every path
+        // and the FILETIME out-params are fully initialised before use.
+        unsafe {
+            // Open FIRST, then verify the creation time on the SAME handle we
+            // will terminate through. A process handle pins one specific process
+            // instance, so the OS cannot recycle the PID to a different live
+            // process between the identity check and the kill. Checking by PID
+            // and then re-opening by PID would leave a TOCTOU window: a recycled
+            // PID could resolve `OpenProcess` to a foreign process that
+            // `TerminateProcess` would then kill.
+            let Ok(handle) = OpenProcess(
+                PROCESS_TERMINATE | PROCESS_QUERY_LIMITED_INFORMATION,
+                false,
+                target.pid,
+            ) else {
+                continue;
+            };
+            let mut creation = FILETIME::default();
+            let mut exit = FILETIME::default();
+            let mut kernel = FILETIME::default();
+            let mut user = FILETIME::default();
+            let times_ok =
+                GetProcessTimes(handle, &mut creation, &mut exit, &mut kernel, &mut user).is_ok();
+            let ct = ((creation.dwHighDateTime as u64) << 32) | creation.dwLowDateTime as u64;
+            if times_ok && ct == target.creation_time && TerminateProcess(handle, 1).is_ok() {
+                killed += 1;
+            }
+            let _ = CloseHandle(handle);
+        }
+    }
+    killed
+}
+
+#[cfg(not(windows))]
+pub fn terminate_processes(_targets: &[VmProcId]) -> usize {
+    0
+}
+
+// ---------------------------------------------------------------------------
+// Cross-process named mutexes
+// ---------------------------------------------------------------------------
+
+/// Acquire a Windows named mutex, waiting up to `timeout`. Returns the handle
+/// and whether we own it (always `true` on success; the handle must be released
+/// + closed on drop). Shared by [`TransitionLock`] and [`HostVmLock`].
+#[cfg(windows)]
+fn named_mutex_acquire(
+    name: &str,
+    timeout: std::time::Duration,
+) -> Result<windows::Win32::Foundation::HANDLE> {
+    use windows::core::PCWSTR;
+    use windows::Win32::Foundation::{WAIT_ABANDONED, WAIT_OBJECT_0};
+    use windows::Win32::System::Threading::{CreateMutexW, WaitForSingleObject};
+
+    let wide: Vec<u16> = name.encode_utf16().chain(std::iter::once(0)).collect();
+
+    // SAFETY: `wide` is a valid null-terminated UTF-16 buffer that outlives the
+    // call; the returned handle is owned by the caller and closed on drop.
+    let handle = unsafe { CreateMutexW(None, false, PCWSTR(wide.as_ptr())) }
+        .context("create named mutex")?;
+
+    let ms = timeout.as_millis().min(u32::MAX as u128) as u32;
+    // SAFETY: `handle` is a valid mutex handle from `CreateMutexW`.
+    let wait = unsafe { WaitForSingleObject(handle, ms) };
+    if wait == WAIT_OBJECT_0 || wait == WAIT_ABANDONED {
+        // WAIT_ABANDONED: a previous holder died without releasing. We now own
+        // the mutex; the protected state is reconciled separately via records /
+        // process-identity proof, so taking ownership here is correct.
+        Ok(handle)
+    } else {
+        // SAFETY: closing the handle we just created; we do not own the mutex.
+        unsafe {
+            let _ = windows::Win32::Foundation::CloseHandle(handle);
+        }
+        anyhow::bail!("timed out acquiring named mutex {name:?} after {timeout:?}");
+    }
+}
+
+/// Release (if owned) and close a named-mutex handle. Shared drop helper.
+#[cfg(windows)]
+fn named_mutex_release(handle: windows::Win32::Foundation::HANDLE, owned: bool) {
+    use windows::Win32::Foundation::CloseHandle;
+    use windows::Win32::System::Threading::ReleaseMutex;
+    // SAFETY: `handle` is a valid mutex handle owned by the caller.
+    unsafe {
+        if owned {
+            let _ = ReleaseMutex(handle);
+        }
+        let _ = CloseHandle(handle);
+    }
+}
+
+/// RAII guard over the named transition mutex. While held, no other phase
+/// process can enter a `start` / `stop` / `deprovision` transition, which
+/// prevents split-brain (double-spawn, kill-wrong-target, contradictory record
+/// writes). Released on drop.
+#[cfg(windows)]
+pub struct TransitionLock {
+    handle: windows::Win32::Foundation::HANDLE,
+    /// Whether we actually own the mutex (vs. failed to acquire). Only an owned
+    /// mutex is released on drop.
+    owned: bool,
+}
+
+#[cfg(windows)]
+impl TransitionLock {
+    /// Acquire the transition mutex, waiting up to `timeout`.
+    pub fn acquire(timeout: std::time::Duration) -> Result<Self> {
+        let handle = named_mutex_acquire(TRANSITION_MUTEX_NAME, timeout)?;
+        Ok(Self {
+            handle,
+            owned: true,
+        })
+    }
+}
+
+#[cfg(windows)]
+impl Drop for TransitionLock {
+    fn drop(&mut self) {
+        named_mutex_release(self.handle, self.owned);
+    }
+}
+
+/// RAII guard over the host-global WSB VM-slot mutex ([`HOST_VM_MUTEX_NAME`]).
+/// Held for the entire lifetime that a process owns the host's single Windows
+/// Sandbox VM (a one-shot run, or a state-aware daemon), so the two modes can
+/// never both launch / own the singleton VM concurrently. Released on drop.
+#[cfg(windows)]
+pub struct HostVmLock {
+    handle: windows::Win32::Foundation::HANDLE,
+    owned: bool,
+}
+
+#[cfg(windows)]
+impl HostVmLock {
+    /// Acquire the host VM-slot mutex, waiting up to `timeout`. On timeout the
+    /// slot is owned by another VM owner (a concurrent one-shot or a live
+    /// state-aware daemon) — the caller should surface this as "busy".
+    pub fn acquire(timeout: std::time::Duration) -> Result<Self> {
+        let handle = named_mutex_acquire(HOST_VM_MUTEX_NAME, timeout)?;
+        Ok(Self {
+            handle,
+            owned: true,
+        })
+    }
+}
+
+#[cfg(windows)]
+impl Drop for HostVmLock {
+    fn drop(&mut self) {
+        named_mutex_release(self.handle, self.owned);
+    }
+}
+
+/// Non-Windows stub: the host VM mutex is a Windows-only concept.
+#[cfg(not(windows))]
+pub struct HostVmLock;
+
+#[cfg(not(windows))]
+impl HostVmLock {
+    pub fn acquire(_timeout: std::time::Duration) -> Result<Self> {
+        Ok(Self)
+    }
+}
diff --git a/src/backends/windows_sandbox/lifecycle/src/error.rs b/src/backends/windows_sandbox/lifecycle/src/error.rs
new file mode 100644
index 000000000..096a6025e
--- /dev/null
+++ b/src/backends/windows_sandbox/lifecycle/src/error.rs
@@ -0,0 +1,147 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Typed failure modes for the transient one-shot Windows Sandbox runner.
+//!
+//! Each variant carries a developer-facing detail string and maps to a
+//! [`ScriptResponse`] with a user-facing `error_message` plus the raw detail
+//! in `extended_error`. Keeping the variants distinct (rather than a single
+//! opaque string) lets the orchestration code attribute a failure to a
+//! specific lifecycle phase and lays the groundwork for richer typed wire
+//! errors in the state-aware backend.
+
+use wxc_common::models::{FailurePhase, ScriptResponse};
+
+/// Failure modes of a single transient one-shot execution.
+#[derive(Debug)]
+pub(crate) enum OneShotError {
+    SandboxUnavailable(String),
+    Busy(String),
+    RuntimeSetup(String),
+    Launch(String),
+    Policy(String),
+    Exec(String),
+}
+
+impl OneShotError {
+    /// Render this error as a [`ScriptResponse`]. The user-facing summary
+    /// lands in both `standard_err` and `error_message`; the raw detail lands
+    /// in `extended_error` for diagnostics.
+    pub(crate) fn into_response(self) -> ScriptResponse {
+        let failure_phase = self.failure_phase();
+        let (summary, detail): (&str, String) = match self {
+            OneShotError::SandboxUnavailable(d) => (
+                "Windows Sandbox is not available on this host. Enable the \
+                 'Containers-DisposableClientVM' optional feature and reboot.",
+                d,
+            ),
+            OneShotError::Busy(d) => (
+                "Windows Sandbox is already running and was not started by a \
+                 disposable MXC run. Refusing to start a one-shot sandbox \
+                 (the host allows only one running instance). Close the \
+                 existing sandbox and retry.",
+                d,
+            ),
+            OneShotError::RuntimeSetup(d) => (
+                "Failed to initialise the async runtime for Windows Sandbox.",
+                d,
+            ),
+            OneShotError::Launch(d) => (
+                "Failed to launch the Windows Sandbox VM or connect to the guest agent.",
+                d,
+            ),
+            OneShotError::Policy(d) => (
+                "The request's policy cannot be enforced by the Windows Sandbox \
+                 backend.",
+                d,
+            ),
+            OneShotError::Exec(d) => ("Execution inside the Windows Sandbox failed.", d),
+        };
+
+        ScriptResponse {
+            exit_code: -1,
+            standard_err: summary.to_string(),
+            error_message: summary.to_string(),
+            extended_error: detail,
+            failure_phase,
+            ..Default::default()
+        }
+    }
+
+    /// Lifecycle phase this error is attributed to, so a caller can decide
+    /// whether a retry could ever succeed.
+    fn failure_phase(&self) -> FailurePhase {
+        match self {
+            // Non-retryable preflight: the request/config cannot be honored or a
+            // required host prerequisite is missing. Retrying the same input on
+            // the same host will not succeed.
+            OneShotError::SandboxUnavailable(_) | OneShotError::Policy(_) => FailurePhase::Rejected,
+            // Launch attempt failed (incl. transient single-instance contention,
+            // async-runtime setup, capture-proof, rendezvous wait, and the
+            // initial guest connect) — generally worth retrying.
+            OneShotError::Busy(_) | OneShotError::RuntimeSetup(_) | OneShotError::Launch(_) => {
+                FailurePhase::LaunchFailed
+            }
+            // The execution relay failed while running user code.
+            OneShotError::Exec(_) => FailurePhase::PostLaunchFailed,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn busy_maps_to_launch_failed_with_detail() {
+        let resp = OneShotError::Busy("vm already up".to_string()).into_response();
+        assert_eq!(resp.exit_code, -1);
+        assert_eq!(resp.failure_phase, FailurePhase::LaunchFailed);
+        assert_eq!(resp.extended_error, "vm already up");
+        assert!(!resp.error_message.is_empty());
+    }
+
+    #[test]
+    fn policy_and_prereq_errors_map_to_rejected() {
+        for err in [
+            OneShotError::Policy("denied path in share".to_string()),
+            OneShotError::SandboxUnavailable("feature off".to_string()),
+        ] {
+            let resp = err.into_response();
+            assert_eq!(
+                resp.failure_phase,
+                FailurePhase::Rejected,
+                "non-retryable preflight should map to Rejected"
+            );
+        }
+    }
+
+    #[test]
+    fn launch_and_exec_errors_map_to_post_launch_phases() {
+        // After `Rendezvous` / `Connect` merged into `Launch`, only Launch +
+        // Exec remain as the post-pre-flight
+        // failure categories. Launch -> retry-the-launch
+        // (LaunchFailed); Exec -> the relay broke after a successful
+        // launch (PostLaunchFailed).
+        assert_eq!(
+            OneShotError::Launch("rendezvous timed out after 360s".to_string())
+                .into_response()
+                .failure_phase,
+            FailurePhase::LaunchFailed
+        );
+        assert_eq!(
+            OneShotError::Exec("relay broke".to_string())
+                .into_response()
+                .failure_phase,
+            FailurePhase::PostLaunchFailed
+        );
+    }
+
+    #[test]
+    fn launch_detail_preserved_in_extended_error() {
+        let resp =
+            OneShotError::Launch("rendezvous timed out after 360s".to_string()).into_response();
+        assert_eq!(resp.extended_error, "rendezvous timed out after 360s");
+        assert!(resp.error_message.contains("launch"));
+    }
+}
diff --git a/src/backends/windows_sandbox/lifecycle/src/ipc_exec.rs b/src/backends/windows_sandbox/lifecycle/src/ipc_exec.rs
new file mode 100644
index 000000000..3cd8ce00d
--- /dev/null
+++ b/src/backends/windows_sandbox/lifecycle/src/ipc_exec.rs
@@ -0,0 +1,256 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Binary exec framing between state-aware `wxc-exec` and the daemon.
+
+use std::io::{self, Read, Write};
+
+use serde::{Deserialize, Serialize};
+use tokio::io::{AsyncRead, AsyncReadExt};
+
+#[repr(u8)]
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+pub enum FrameKind {
+    Stdout = 1,
+    Stderr = 2,
+    Exit = 3,
+    Stdin = 4,
+}
+
+impl FrameKind {
+    pub fn from_wire(value: u8) -> Option<Self> {
+        match value {
+            1 => Some(Self::Stdout),
+            2 => Some(Self::Stderr),
+            3 => Some(Self::Exit),
+            4 => Some(Self::Stdin),
+            _ => None,
+        }
+    }
+
+    pub fn to_wire(self) -> u8 {
+        self as u8
+    }
+}
+
+/// Upper bound on a single IPC frame's payload.
+pub const MAX_IPC_FRAME: usize = 16 * 1024 * 1024;
+
+/// Request payload sent by the exec-phase client to start an execution.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ExecStart {
+    /// Command line to run inside the sandbox (passed to `cmd.exe /C`).
+    pub script_code: String,
+    /// Working directory inside the sandbox (empty = guest default).
+    pub working_directory: String,
+    /// Timeout in milliseconds (0 = no timeout). Enforced guest-side.
+    pub timeout_ms: u32,
+}
+
+/// Terminal exit payload (the body of a [`FrameKind::Exit`] frame).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ExecExit {
+    /// Child process exit code (negative = error/timeout).
+    pub exit_code: i32,
+    /// Optional error message (e.g. spawn failure or timeout).
+    pub error_message: String,
+}
+
+/// Encode a binary data frame: `[kind][len: u32 LE][payload]`.
+pub fn encode_frame(kind: FrameKind, payload: &[u8]) -> Vec<u8> {
+    let mut out = Vec::with_capacity(5 + payload.len());
+    out.push(kind.to_wire());
+    out.extend_from_slice(&(payload.len() as u32).to_le_bytes());
+    out.extend_from_slice(payload);
+    out
+}
+
+/// The 5-byte data-frame header (`[kind][len: u32 LE]`) without payload.
+pub fn frame_header(kind: FrameKind, payload_len: usize) -> [u8; 5] {
+    let mut h = [0u8; 5];
+    h[0] = kind.to_wire();
+    h[1..].copy_from_slice(&(payload_len as u32).to_le_bytes());
+    h
+}
+
+/// Encode the [`FrameKind::Exit`] frame for the given exit code / message.
+pub fn encode_exit_frame(
+    exit_code: i32,
+    error_message: &str,
+) -> Result<Vec<u8>, serde_json::Error> {
+    let payload = serde_json::to_vec(&ExecExit {
+        exit_code,
+        error_message: error_message.to_string(),
+    })?;
+    Ok(encode_frame(FrameKind::Exit, &payload))
+}
+
+/// Encode the request frame (4-byte LE length prefix + JSON [`ExecStart`]).
+pub fn encode_exec_start(req: &ExecStart) -> Result<Vec<u8>, serde_json::Error> {
+    let json = serde_json::to_vec(req)?;
+    let mut out = Vec::with_capacity(4 + json.len());
+    out.extend_from_slice(&(json.len() as u32).to_le_bytes());
+    out.extend_from_slice(&json);
+    Ok(out)
+}
+
+/// Decode an [`ExecStart`] from a JSON payload (the bytes after the 4-byte
+/// length prefix). Used by the daemon after reading the framed request.
+pub fn decode_exec_start(payload: &[u8]) -> Result<ExecStart, serde_json::Error> {
+    serde_json::from_slice(payload)
+}
+
+/// Read the framed [`ExecStart`] request from an async stream.
+pub async fn read_exec_start_async<R: AsyncRead + Unpin>(r: &mut R) -> io::Result<ExecStart> {
+    let mut len_buf = [0u8; 4];
+    r.read_exact(&mut len_buf).await?;
+    let len = u32::from_le_bytes(len_buf) as usize;
+    if len > MAX_IPC_FRAME {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("ExecStart frame too large: {len} bytes"),
+        ));
+    }
+    let mut payload = vec![0u8; len];
+    r.read_exact(&mut payload).await?;
+    decode_exec_start(&payload)
+        .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, format!("decode ExecStart: {e}")))
+}
+
+/// Write the [`ExecStart`] request frame to a synchronous stream.
+pub fn write_exec_start<W: Write>(w: &mut W, req: &ExecStart) -> io::Result<()> {
+    let frame = encode_exec_start(req).map_err(|e| {
+        io::Error::new(io::ErrorKind::InvalidData, format!("encode ExecStart: {e}"))
+    })?;
+    w.write_all(&frame)
+}
+
+/// One decoded data frame read from a synchronous stream.
+#[derive(Debug, PartialEq, Eq)]
+pub struct DataFrame {
+    /// Frame kind, if this peer knows it.
+    pub kind: Option<FrameKind>,
+    /// Raw wire frame kind byte, retained for diagnostics and forward-compatibility.
+    pub raw_kind: u8,
+    /// Frame payload bytes.
+    pub payload: Vec<u8>,
+}
+
+/// Read one data frame from a synchronous stream.
+pub fn read_frame<R: Read>(r: &mut R) -> io::Result<Option<DataFrame>> {
+    let mut header = [0u8; 5];
+    match r.read(&mut header[..1])? {
+        0 => return Ok(None),
+        1 => {}
+        _ => unreachable!("read into a 1-byte slice cannot exceed 1"),
+    }
+    r.read_exact(&mut header[1..])?;
+    let raw_kind = header[0];
+    let len = u32::from_le_bytes([header[1], header[2], header[3], header[4]]) as usize;
+    if len > MAX_IPC_FRAME {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("IPC frame too large: {len} bytes"),
+        ));
+    }
+    let mut payload = vec![0u8; len];
+    r.read_exact(&mut payload)?;
+    Ok(Some(DataFrame {
+        kind: FrameKind::from_wire(raw_kind),
+        raw_kind,
+        payload,
+    }))
+}
+
+/// Async mirror of [`read_frame`].
+pub async fn read_frame_async<R: AsyncRead + Unpin>(r: &mut R) -> io::Result<Option<DataFrame>> {
+    let mut first = [0u8; 1];
+    match r.read(&mut first).await? {
+        0 => return Ok(None),
+        1 => {}
+        _ => unreachable!("read into a 1-byte slice cannot exceed 1"),
+    }
+    let mut tail = [0u8; 4];
+    r.read_exact(&mut tail).await?;
+    let raw_kind = first[0];
+    let len = u32::from_le_bytes(tail) as usize;
+    if len > MAX_IPC_FRAME {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("IPC frame too large: {len} bytes"),
+        ));
+    }
+    let mut payload = vec![0u8; len];
+    r.read_exact(&mut payload).await?;
+    Ok(Some(DataFrame {
+        kind: FrameKind::from_wire(raw_kind),
+        raw_kind,
+        payload,
+    }))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Cursor;
+
+    #[test]
+    fn exec_start_roundtrips() {
+        let req = ExecStart {
+            script_code: "echo hi".into(),
+            working_directory: "C:\\work".into(),
+            timeout_ms: 30_000,
+        };
+        let frame = encode_exec_start(&req).unwrap();
+        let declared = u32::from_le_bytes([frame[0], frame[1], frame[2], frame[3]]) as usize;
+        assert_eq!(declared, frame.len() - 4);
+        assert_eq!(decode_exec_start(&frame[4..]).unwrap(), req);
+    }
+
+    #[test]
+    fn data_frame_roundtrips() {
+        let mut buf = Vec::new();
+        buf.extend_from_slice(&encode_frame(FrameKind::Stdout, b"hello"));
+        buf.extend_from_slice(&encode_frame(FrameKind::Stderr, b"warn"));
+        buf.extend_from_slice(&encode_exit_frame(42, "boom").unwrap());
+
+        let mut cur = Cursor::new(buf);
+        let f1 = read_frame(&mut cur).unwrap().unwrap();
+        assert_eq!(f1.kind, Some(FrameKind::Stdout));
+        assert_eq!(f1.payload, b"hello");
+        let f2 = read_frame(&mut cur).unwrap().unwrap();
+        assert_eq!(f2.kind, Some(FrameKind::Stderr));
+        assert_eq!(f2.payload, b"warn");
+        let f3 = read_frame(&mut cur).unwrap().unwrap();
+        assert_eq!(f3.kind, Some(FrameKind::Exit));
+        let exit: ExecExit = serde_json::from_slice(&f3.payload).unwrap();
+        assert_eq!(
+            exit,
+            ExecExit {
+                exit_code: 42,
+                error_message: "boom".into()
+            }
+        );
+        // Clean EOF at a frame boundary.
+        assert_eq!(read_frame(&mut cur).unwrap(), None);
+    }
+
+    #[test]
+    fn partial_frame_is_unexpected_eof() {
+        // kind + truncated length header.
+        let buf = vec![FrameKind::Stdout.to_wire(), 0x10, 0x00];
+        let mut cur = Cursor::new(buf);
+        let err = read_frame(&mut cur).unwrap_err();
+        assert_eq!(err.kind(), io::ErrorKind::UnexpectedEof);
+    }
+
+    #[test]
+    fn oversize_frame_is_rejected() {
+        let mut buf = Vec::new();
+        buf.push(FrameKind::Stdout.to_wire());
+        buf.extend_from_slice(&((MAX_IPC_FRAME as u32) + 1).to_le_bytes());
+        let mut cur = Cursor::new(buf);
+        let err = read_frame(&mut cur).unwrap_err();
+        assert_eq!(err.kind(), io::ErrorKind::InvalidData);
+    }
+}
diff --git a/src/backends/windows_sandbox/lifecycle/src/lib.rs b/src/backends/windows_sandbox/lifecycle/src/lib.rs
new file mode 100644
index 000000000..020fad256
--- /dev/null
+++ b/src/backends/windows_sandbox/lifecycle/src/lib.rs
@@ -0,0 +1,28 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Windows Sandbox VM lifecycle primitives.
+//!
+//! [`vm`] launches and probes the VM, [`rendezvous`] discovers the guest, and
+//! [`bridge`] relays executions. Consumers own retry, reuse, and idle-teardown
+//! policy. The transient [`WindowsSandboxRunner`] composes these primitives for
+//! one-shot execution.
+
+pub mod bridge;
+pub mod constants;
+pub mod control_plane;
+pub mod ipc_exec;
+pub mod rendezvous;
+pub mod vm;
+
+#[cfg(windows)]
+mod error;
+#[cfg(windows)]
+mod one_shot;
+#[cfg(windows)]
+mod policy;
+#[cfg(windows)]
+mod teardown;
+
+#[cfg(windows)]
+pub use one_shot::WindowsSandboxRunner;
diff --git a/src/backends/windows_sandbox/lifecycle/src/one_shot.rs b/src/backends/windows_sandbox/lifecycle/src/one_shot.rs
new file mode 100644
index 000000000..8096a56f7
--- /dev/null
+++ b/src/backends/windows_sandbox/lifecycle/src/one_shot.rs
@@ -0,0 +1,357 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Transient one-shot `ScriptRunner` for the Windows Sandbox backend.
+//!
+//! Each execution gets a fresh VM and an ownership-scoped teardown guard. The
+//! host VM-slot mutex serialises one-shot runs with each other and with the
+//! state-aware daemon.
+
+use std::path::PathBuf;
+use std::time::Duration;
+
+use wxc_common::logger::Logger;
+use wxc_common::models::{ExecutionRequest, FailurePhase, ScriptResponse};
+use wxc_common::script_runner::{get_timeout_milliseconds, ScriptRunner};
+
+use crate::control_plane::{self, HostVmLock};
+use crate::error::OneShotError;
+use crate::rendezvous::{GUEST_CONNECT_TIMEOUT, RENDEZVOUS_POLL_INTERVAL, RENDEZVOUS_TIMEOUT};
+use crate::teardown::{self, Reconcile, VmTeardownGuard};
+use crate::{bridge, policy, vm};
+
+use windows_sandbox_common::auth as wsb_auth;
+
+const HOST_VM_LOCK_TIMEOUT: Duration = Duration::from_secs(5);
+
+/// Stateless marker type whose [`ScriptRunner`] impl drives a disposable
+/// Windows Sandbox VM through launch → exec → teardown in a single process.
+#[derive(Debug, Default)]
+pub struct WindowsSandboxRunner;
+
+impl WindowsSandboxRunner {
+    /// Create a new transient one-shot runner.
+    pub fn new() -> Self {
+        Self
+    }
+
+    /// Run the full disposable lifecycle.
+    fn run_one_shot(
+        &self,
+        request: &ExecutionRequest,
+        logger: &mut Logger,
+    ) -> Result<ScriptResponse, OneShotError> {
+        use std::fmt::Write;
+
+        ensure_no_tokio_runtime()?;
+
+        if let Err(e) = check_sandbox_available() {
+            return Err(OneShotError::SandboxUnavailable(e));
+        }
+        let guest_dir = current_exe_dir().map_err(OneShotError::Launch)?;
+
+        let plan = policy::plan_policy(request)?;
+
+        let _vm_lock = HostVmLock::acquire(HOST_VM_LOCK_TIMEOUT).map_err(|e| {
+            OneShotError::Busy(format!(
+                "another Windows Sandbox VM owner holds the host slot: {e:#}"
+            ))
+        })?;
+
+        teardown::secure_markers_root()
+            .map_err(|e| OneShotError::Launch(format!("secure markers root: {e:#}")))?;
+
+        let markers_root = teardown::markers_root();
+        let reclaim_note = match teardown::reconcile_existing_vm(&markers_root) {
+            Reconcile::Proceed(note) => note,
+            Reconcile::Busy(detail) => return Err(OneShotError::Busy(detail)),
+        };
+
+        teardown::gc_orphan_scratch_dirs(&markers_root);
+
+        let run_dir = markers_root.join(uuid::Uuid::new_v4().to_string());
+        let rendezvous_dir = run_dir.join("rendezvous");
+        let config_dir = run_dir.join("config");
+        std::fs::create_dir_all(&run_dir)
+            .map_err(|e| OneShotError::Launch(format!("create run dir: {e}")))?;
+        control_plane::set_owner_only_dir(&run_dir)
+            .map_err(|e| OneShotError::Launch(format!("secure run dir: {e:#}")))?;
+        std::fs::create_dir_all(&rendezvous_dir)
+            .map_err(|e| OneShotError::Launch(format!("create rendezvous dir: {e}")))?;
+        std::fs::create_dir_all(&config_dir)
+            .map_err(|e| OneShotError::Launch(format!("create config dir: {e}")))?;
+        teardown::write_marker(&run_dir)
+            .map_err(|e| OneShotError::Launch(format!("write run marker: {e}")))?;
+
+        let wsb_path = vm::generate_wsb(
+            &guest_dir,
+            &rendezvous_dir,
+            &config_dir,
+            &plan.mapped_folders,
+        )
+        .map_err(|e| OneShotError::Launch(format!("{e:#}")))?;
+
+        let _guard = VmTeardownGuard::arm(run_dir.clone());
+
+        let _ = writeln!(logger, "Windows Sandbox: launching disposable VM");
+
+        let stdin_handle = std::thread::Builder::new()
+            .name("wxc-host-stdin-spool".into())
+            .spawn(capture_host_stdin)
+            .map_err(|e| {
+                OneShotError::RuntimeSetup(format!("spawn host stdin spool thread: {e}"))
+            })?;
+
+        let runtime = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .map_err(|e| OneShotError::RuntimeSetup(format!("{e}")))?;
+
+        let exec = runtime.block_on(drive(
+            &wsb_path,
+            &rendezvous_dir,
+            &run_dir,
+            request,
+            stdin_handle,
+        ))?;
+
+        let mut response = exec_to_response(exec);
+        if let Some(note) = reclaim_note {
+            response.extended_error = note;
+        }
+        Ok(response)
+        // Drop order tears down the runtime before the VM guard.
+    }
+}
+
+impl ScriptRunner for WindowsSandboxRunner {
+    fn execute(&mut self, request: &ExecutionRequest, logger: &mut Logger) -> ScriptResponse {
+        match self.run_one_shot(request, logger) {
+            Ok(response) => response,
+            Err(err) => err.into_response(),
+        }
+    }
+}
+
+fn ensure_no_tokio_runtime() -> Result<(), OneShotError> {
+    if tokio::runtime::Handle::try_current().is_ok() {
+        Err(OneShotError::RuntimeSetup(
+            "Windows Sandbox one-shot runner cannot run inside an existing tokio runtime"
+                .to_string(),
+        ))
+    } else {
+        Ok(())
+    }
+}
+
+/// Drive the async launch/rendezvous/connect/execute path.
+async fn drive(
+    wsb_path: &std::path::Path,
+    rendezvous_dir: &std::path::Path,
+    run_dir: &std::path::Path,
+    request: &ExecutionRequest,
+    host_stdin: std::thread::JoinHandle<Vec<u8>>,
+) -> Result<bridge::ExecResult, OneShotError> {
+    let nonce = wsb_auth::generate_nonce()
+        .map_err(|e| OneShotError::RuntimeSetup(format!("generate launch nonce: {e}")))?;
+
+    let mut observer = OneShotLaunchObserver { run_dir };
+    let (mut conn, _addr) = vm::launch_managed_vm(
+        wsb_path,
+        rendezvous_dir,
+        &nonce,
+        RENDEZVOUS_TIMEOUT,
+        RENDEZVOUS_POLL_INTERVAL,
+        GUEST_CONNECT_TIMEOUT,
+        &mut observer,
+    )
+    .await
+    .map_err(|e| OneShotError::Launch(format!("{e:#}")))?;
+
+    // Stdin capture overlaps VM boot; a capture panic degrades to empty stdin.
+    let host_stdin_bytes = host_stdin.join().unwrap_or_else(|panic| {
+        eprintln!(
+            "[one-shot] WARNING: host stdin spool thread panicked: {panic:?}; continuing with \
+             empty stdin"
+        );
+        Vec::new()
+    });
+
+    let exec_id = uuid::Uuid::new_v4().to_string();
+    let timeout_ms = get_timeout_milliseconds(request.script_timeout);
+    bridge::execute_on_guest(
+        &mut conn,
+        &exec_id,
+        &request.script_code,
+        &request.working_directory,
+        timeout_ms,
+        &host_stdin_bytes,
+    )
+    .await
+    .map_err(|e| OneShotError::Exec(format!("{e:#}")))
+}
+
+/// One-shot's [`vm::LaunchObserver`] adapter.
+struct OneShotLaunchObserver<'a> {
+    run_dir: &'a std::path::Path,
+}
+
+impl<'a> vm::LaunchObserver for OneShotLaunchObserver<'a> {
+    fn set_ownership(&mut self, state: control_plane::VmOwnership) {
+        teardown::set_vm_ownership(state);
+    }
+
+    fn persist_proof(&mut self, proof: &[control_plane::VmProcId]) -> anyhow::Result<()> {
+        teardown::rewrite_marker_with_proof(self.run_dir, proof)
+            .map_err(|e| anyhow::anyhow!("record VM ownership proof: {e}"))
+    }
+
+    fn note_empty_proof(&self) {
+        eprintln!(
+            "[one-shot] WARNING: no WindowsSandbox* host processes appeared within \
+             capture_launch_proof's budget; staying at LaunchSucceededNoProof. Teardown will \
+             enumerate-kill if any host processes are visible at exit; the pre-launch marker \
+             (with empty vm_processes) is preserved so reclaim of this VM by a later one-shot is \
+             not possible by positive proof. If the launcher hard-dies before exit, the VM may \
+             require manual cleanup."
+        );
+    }
+}
+
+/// Maximum buffered stdin for the one-shot, non-streaming protocol.
+const MAX_HOST_STDIN_BYTES: usize = 64 * 1024 * 1024;
+
+/// Capture wxc-exec's own stdin to a byte buffer for forwarding to the guest.
+///
+/// TTY input is skipped to avoid blocking. Piped input is capped at
+/// [`MAX_HOST_STDIN_BYTES`] and captured on a thread that overlaps VM boot.
+fn capture_host_stdin() -> Vec<u8> {
+    use std::io::{IsTerminal, Read};
+    let mut stdin = std::io::stdin();
+    if stdin.is_terminal() {
+        return Vec::new();
+    }
+    let mut buf = Vec::new();
+    // Read one byte past the cap to detect overflow without buffering the rest.
+    if let Err(e) = stdin
+        .by_ref()
+        .take((MAX_HOST_STDIN_BYTES as u64) + 1)
+        .read_to_end(&mut buf)
+    {
+        eprintln!(
+            "[one-shot] WARNING: failed to capture stdin for sandbox forwarding ({e}); \
+             continuing with empty stdin"
+        );
+        return Vec::new();
+    }
+    if buf.len() > MAX_HOST_STDIN_BYTES {
+        eprintln!(
+            "[one-shot] WARNING: host stdin exceeds {MAX_HOST_STDIN_BYTES} bytes; truncating to \
+             the cap and discarding the remainder. Use the state-aware backend (which streams \
+             stdin) for large stdin workloads."
+        );
+        buf.truncate(MAX_HOST_STDIN_BYTES);
+    }
+    buf
+}
+
+/// Map a successful guest execution to a [`ScriptResponse`].
+fn exec_to_response(exec: bridge::ExecResult) -> ScriptResponse {
+    let stdout = String::from_utf8_lossy(&exec.stdout).into_owned();
+    let stderr = String::from_utf8_lossy(&exec.stderr).into_owned();
+    let error_message = if exec.error_message.is_empty() {
+        stderr.clone()
+    } else {
+        exec.error_message
+    };
+    let failure_phase = if exec.exit_code == 0 {
+        FailurePhase::None
+    } else {
+        FailurePhase::ProcessExited
+    };
+    ScriptResponse {
+        exit_code: exec.exit_code,
+        standard_out: stdout,
+        standard_err: stderr,
+        error_message,
+        failure_phase,
+        ..Default::default()
+    }
+}
+
+/// Directory containing the running `wxc-exec` binary, alongside which the
+/// guest agent binary is mapped read-only into the sandbox.
+fn current_exe_dir() -> Result<PathBuf, String> {
+    std::env::current_exe()
+        .map_err(|e| format!("current_exe: {e}"))?
+        .parent()
+        .map(|p| p.to_path_buf())
+        .ok_or_else(|| "current_exe has no parent directory".to_string())
+}
+
+/// Check whether Windows Sandbox is installed by probing for
+/// `WindowsSandbox.exe`.
+///
+/// Detection is by binary presence rather than a DISM feature query, which
+/// requires elevation and fails for ordinary users.
+fn check_sandbox_available() -> Result<(), String> {
+    let system_root = std::env::var("SystemRoot").unwrap_or_else(|_| r"C:\Windows".to_string());
+    let sandbox_exe = std::path::Path::new(&system_root)
+        .join("System32")
+        .join("WindowsSandbox.exe");
+    if sandbox_exe.exists() {
+        Ok(())
+    } else {
+        Err(format!("{} not found", sandbox_exe.display()))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn no_tokio_runtime_is_accepted() {
+        assert!(ensure_no_tokio_runtime().is_ok());
+    }
+
+    #[tokio::test]
+    async fn existing_tokio_runtime_is_rejected() {
+        assert!(matches!(
+            ensure_no_tokio_runtime(),
+            Err(OneShotError::RuntimeSetup(message))
+                if message.contains("existing tokio runtime")
+        ));
+    }
+
+    #[test]
+    fn exec_to_response_zero_exit_is_no_failure() {
+        let exec = bridge::ExecResult {
+            exit_code: 0,
+            error_message: String::new(),
+            stdout: b"hello\n".to_vec(),
+            stderr: Vec::new(),
+            control_residual: Vec::new(),
+        };
+        let resp = exec_to_response(exec);
+        assert_eq!(resp.exit_code, 0);
+        assert_eq!(resp.standard_out, "hello\n");
+        assert_eq!(resp.failure_phase, FailurePhase::None);
+    }
+
+    #[test]
+    fn exec_to_response_nonzero_exit_is_process_exited() {
+        let exec = bridge::ExecResult {
+            exit_code: 42,
+            error_message: String::new(),
+            stdout: Vec::new(),
+            stderr: b"boom\n".to_vec(),
+            control_residual: Vec::new(),
+        };
+        let resp = exec_to_response(exec);
+        assert_eq!(resp.exit_code, 42);
+        assert_eq!(resp.failure_phase, FailurePhase::ProcessExited);
+        // stderr is mirrored into error_message when the agent gave none.
+        assert_eq!(resp.error_message, "boom\n");
+    }
+}
diff --git a/src/backends/windows_sandbox/lifecycle/src/policy.rs b/src/backends/windows_sandbox/lifecycle/src/policy.rs
new file mode 100644
index 000000000..cfd9ac238
--- /dev/null
+++ b/src/backends/windows_sandbox/lifecycle/src/policy.rs
@@ -0,0 +1,585 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Translate request policy into Windows Sandbox mapped folders and rejects.
+//!
+//! Windows Sandbox shares nothing by default. Mapped read/write and read-only
+//! directories are additive; denied paths that overlap a mapped share are
+//! rejected because Windows Sandbox has no per-path deny primitive. Network
+//! isolation is currently all-or-nothing and enforced by the guest firewall.
+
+use std::path::Path;
+
+use wxc_common::models::{ExecutionRequest, NetworkPolicy};
+
+use crate::error::OneShotError;
+use crate::vm::MappedFolder;
+
+/// The enforceable shape of a request's policy for one disposable run.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct WsbPolicyPlan {
+    /// Extra host folders to expose inside the guest.
+    pub(crate) mapped_folders: Vec<MappedFolder>,
+}
+
+/// Validate the request's policy and produce a [`WsbPolicyPlan`].
+pub(crate) fn plan_policy(request: &ExecutionRequest) -> Result<WsbPolicyPlan, OneShotError> {
+    validate_network(request)?;
+    let mapped_folders = plan_filesystem(request)?;
+
+    Ok(WsbPolicyPlan { mapped_folders })
+}
+
+/// Validate the network portion of the policy. `Block` (the schema default) is
+/// honored natively by the guest agent's firewall lockdown, so it needs no
+/// host-side action. Everything else the backend cannot express is rejected.
+fn validate_network(request: &ExecutionRequest) -> Result<(), OneShotError> {
+    let policy = &request.policy;
+
+    if !policy.allowed_hosts.is_empty() || !policy.blocked_hosts.is_empty() {
+        return Err(OneShotError::Policy(
+            "per-host network filtering (allowedHosts/blockedHosts) is not supported by the \
+             Windows Sandbox backend; the guest agent enforces all-or-nothing network isolation"
+                .to_string(),
+        ));
+    }
+    if policy.network_proxy.is_enabled() {
+        return Err(OneShotError::Policy(
+            "a network proxy is not supported by the Windows Sandbox backend".to_string(),
+        ));
+    }
+
+    match policy.default_network_policy {
+        NetworkPolicy::Block => Ok(()),
+        NetworkPolicy::Allow => Err(OneShotError::Policy(
+            "outbound network access (network policy 'allow') is not supported by the Windows \
+             Sandbox backend; the guest agent enforces network isolation"
+                .to_string(),
+        )),
+    }
+}
+
+/// A mapped root in normalized form: the cleaned absolute string used for the
+/// `.wsb` plus its lowercased path components for containment comparisons.
+struct MappedRoot {
+    display: String,
+    components: Vec<String>,
+    read_only: bool,
+}
+
+/// Resolve `readwrite`/`readonly` paths into mapped folders and validate
+/// `deniedPaths` against them.
+fn plan_filesystem(request: &ExecutionRequest) -> Result<Vec<MappedFolder>, OneShotError> {
+    let policy = &request.policy;
+    let mut roots: Vec<MappedRoot> = Vec::new();
+
+    for path in &policy.readwrite_paths {
+        add_mapped_root(&mut roots, path, false)?;
+    }
+    for path in &policy.readonly_paths {
+        add_mapped_root(&mut roots, path, true)?;
+    }
+
+    reject_denied_overlapping_shares(&policy.denied_paths, &roots)?;
+
+    Ok(roots
+        .into_iter()
+        .map(|root| MappedFolder {
+            host: root.display.clone(),
+            sandbox: root.display,
+            read_only: root.read_only,
+        })
+        .collect())
+}
+
+/// Canonicalize `raw`, ensure it is an existing directory, and add it to
+/// `roots` — rejecting missing paths, files, conflicting read-only flags for
+/// the same path, and overlapping (nested) mapped roots.
+fn add_mapped_root(
+    roots: &mut Vec<MappedRoot>,
+    raw: &str,
+    read_only: bool,
+) -> Result<(), OneShotError> {
+    let canonical = std::fs::canonicalize(raw).map_err(|e| {
+        OneShotError::Policy(format!(
+            "mapped path {raw:?} does not exist or is inaccessible (Windows Sandbox cannot map a \
+             missing host folder): {e}"
+        ))
+    })?;
+
+    let is_dir = canonical.is_dir();
+    let display = strip_verbatim_prefix(&canonical.to_string_lossy());
+    if !is_dir {
+        return Err(OneShotError::Policy(format!(
+            "mapped path {raw:?} is a file; Windows Sandbox can only map directories. Map its \
+             parent directory instead."
+        )));
+    }
+
+    let components = path_components(&display);
+
+    for existing in roots.iter() {
+        if existing.components == components {
+            if existing.read_only != read_only {
+                return Err(OneShotError::Policy(format!(
+                    "path {display:?} is listed as both read-write and read-only"
+                )));
+            }
+            // Identical duplicate with the same access — collapse silently.
+            return Ok(());
+        }
+        if is_descendant(&components, &existing.components)
+            || is_descendant(&existing.components, &components)
+        {
+            return Err(OneShotError::Policy(format!(
+                "mapped path {display:?} overlaps another mapped path {:?}; Windows Sandbox \
+                 rejects nested mapped folders",
+                existing.display
+            )));
+        }
+    }
+
+    roots.push(MappedRoot {
+        display,
+        components,
+        read_only,
+    });
+    Ok(())
+}
+
+/// Reject any denied path that *overlaps* a mapped share in either direction —
+/// Windows Sandbox has no per-path Deny primitive, so neither carving a denied
+/// hole out of a share nor denying a subtree that contains a share can be
+/// honored. Denied paths outside every share are no-ops (the host shares
+/// nothing by default) and are silently accepted.
+///
+/// Denied paths must be absolute; a relative path cannot be anchored to a host
+/// location, so it is rejected fail-closed rather than silently treated as a
+/// non-overlapping no-op. Overlap is decided on canonicalized components (see
+/// [`normalize_denied`]) so short names / junctions / case cannot smuggle an
+/// overlapping path past the check.
+fn reject_denied_overlapping_shares(
+    denied_paths: &[String],
+    roots: &[MappedRoot],
+) -> Result<(), OneShotError> {
+    for denied in denied_paths {
+        let denied_components = normalize_denied(denied)?;
+        if denied_components.is_empty() {
+            continue;
+        }
+        for root in roots {
+            if denied_components == root.components {
+                return Err(OneShotError::Policy(format!(
+                    "denied path {denied:?} is the same as mapped share {:?}; the Windows Sandbox \
+                     backend cannot map a folder and deny it at the same time",
+                    root.display
+                )));
+            }
+            if is_descendant(&denied_components, &root.components) {
+                return Err(OneShotError::Policy(format!(
+                    "denied path {denied:?} lies inside mapped share {:?}; the Windows Sandbox \
+                     backend cannot carve a denied subtree out of a mapped folder",
+                    root.display
+                )));
+            }
+            if is_descendant(&root.components, &denied_components) {
+                return Err(OneShotError::Policy(format!(
+                    "denied path {denied:?} contains mapped share {:?}; the Windows Sandbox \
+                     backend cannot deny a host subtree while a folder inside it is mapped",
+                    root.display
+                )));
+            }
+        }
+    }
+    Ok(())
+}
+
+/// Normalize a denied path to comparison components, mirroring the
+/// canonicalization applied to mapped roots so the two are compared
+/// apples-to-apples.
+///
+/// - Rejects a non-absolute path (it cannot be anchored to a host location).
+/// - Canonicalizes the full path when it exists (resolves 8.3 short names,
+///   junctions/symlinks, and case to the same form a mapped root gets).
+/// - When the leaf does not yet exist, canonicalizes the longest existing
+///   ancestor and appends the remaining lexical tail — but only when that
+///   ancestor is a genuine prefix of the lexical path, otherwise falls back to
+///   the purely lexical form rather than risk constructing a wrong path.
+/// - Falls back to lexical normalization when nothing along the path exists.
+fn normalize_denied(raw: &str) -> Result<Vec<String>, OneShotError> {
+    let p = Path::new(raw);
+    if !p.is_absolute() {
+        return Err(OneShotError::Policy(format!(
+            "denied path {raw:?} is not an absolute host path; deniedPaths must be absolute so the \
+             Windows Sandbox backend can determine whether they overlap a mapped share"
+        )));
+    }
+
+    let lexical = path_components(&strip_verbatim_prefix(raw));
+
+    if let Ok(canonical) = std::fs::canonicalize(p) {
+        return Ok(path_components(&strip_verbatim_prefix(
+            &canonical.to_string_lossy(),
+        )));
+    }
+
+    for ancestor in p.ancestors().skip(1) {
+        if ancestor.as_os_str().is_empty() {
+            continue;
+        }
+        if let Ok(canonical) = std::fs::canonicalize(ancestor) {
+            let ancestor_lexical =
+                path_components(&strip_verbatim_prefix(&ancestor.to_string_lossy()));
+            // Trust the canonical ancestor only when it is a genuine prefix of
+            // the lexical path; a `..` straddling a partially-existing path
+            // could otherwise yield a wrong reconstruction, so prefer the
+            // lexical form in that pathological case.
+            if ancestor_lexical.len() <= lexical.len() && lexical.starts_with(&ancestor_lexical) {
+                let mut components =
+                    path_components(&strip_verbatim_prefix(&canonical.to_string_lossy()));
+                components.extend_from_slice(&lexical[ancestor_lexical.len()..]);
+                return Ok(components);
+            }
+            break;
+        }
+    }
+
+    Ok(lexical)
+}
+
+/// Strip a `\\?\` or `\\?\UNC\` verbatim prefix from a Windows path string.
+/// `std::fs::canonicalize` returns verbatim paths, which Windows Sandbox does
+/// not accept in a `.wsb`.
+fn strip_verbatim_prefix(path: &str) -> String {
+    if let Some(rest) = path.strip_prefix(r"\\?\UNC\") {
+        format!(r"\\{rest}")
+    } else if let Some(rest) = path.strip_prefix(r"\\?\") {
+        rest.to_string()
+    } else {
+        path.to_string()
+    }
+}
+
+/// Split a path into case-folded, normalized components for case-insensitive
+/// comparison. `.` segments are dropped and `..` pops the previous component.
+/// Drive/separator forms are unified by splitting on both `\` and `/`. Folding
+/// is Unicode-aware (`to_lowercase`) rather than ASCII-only so non-ASCII path
+/// segments cannot vary in case to slip a denied path past the overlap check.
+fn path_components(path: &str) -> Vec<String> {
+    let mut out: Vec<String> = Vec::new();
+    for raw in path.split(['\\', '/']) {
+        match raw {
+            "" | "." => {}
+            ".." => {
+                out.pop();
+            }
+            seg => out.push(seg.to_lowercase()),
+        }
+    }
+    out
+}
+
+/// True when `child` is strictly nested inside `ancestor` (component-wise
+/// prefix, longer than the ancestor). Component-wise comparison avoids the
+/// `C:\foo` vs `C:\foobar` false positive a string-prefix test would hit.
+fn is_descendant(child: &[String], ancestor: &[String]) -> bool {
+    child.len() > ancestor.len() && child.starts_with(ancestor)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use wxc_common::models::{ContainerPolicy, ProxyAddress, ProxyConfig};
+
+    fn request_with(policy: ContainerPolicy) -> ExecutionRequest {
+        ExecutionRequest {
+            policy,
+            ..Default::default()
+        }
+    }
+
+    fn assert_policy_err_contains(err: OneShotError, expected: &str) {
+        match err {
+            OneShotError::Policy(msg) => {
+                assert!(msg.contains(expected), "expected {expected:?} in {msg:?}")
+            }
+            other => panic!("expected Policy variant, got {other:?}"),
+        }
+    }
+
+    // ===== network =====
+
+    #[test]
+    fn default_policy_blocks_network_and_maps_nothing() {
+        // Schema default is Block, which is honored natively (guest enforces).
+        let plan = plan_policy(&ExecutionRequest::default()).unwrap();
+        assert!(plan.mapped_folders.is_empty());
+    }
+
+    #[test]
+    fn allow_network_rejected() {
+        let err = plan_policy(&request_with(ContainerPolicy {
+            default_network_policy: NetworkPolicy::Allow,
+            ..Default::default()
+        }))
+        .unwrap_err();
+        assert_policy_err_contains(err, "outbound network access");
+    }
+
+    #[test]
+    fn allowed_hosts_rejected() {
+        let err = plan_policy(&request_with(ContainerPolicy {
+            allowed_hosts: vec!["example.com".to_string()],
+            ..Default::default()
+        }))
+        .unwrap_err();
+        assert_policy_err_contains(err, "per-host network filtering");
+    }
+
+    #[test]
+    fn blocked_hosts_rejected() {
+        let err = plan_policy(&request_with(ContainerPolicy {
+            blocked_hosts: vec!["evil.com".to_string()],
+            ..Default::default()
+        }))
+        .unwrap_err();
+        assert_policy_err_contains(err, "per-host network filtering");
+    }
+
+    #[test]
+    fn proxy_rejected() {
+        let err = plan_policy(&request_with(ContainerPolicy {
+            network_proxy: ProxyConfig {
+                address: Some(ProxyAddress::new("127.0.0.1".to_string(), 8080)),
+                builtin_test_server: false,
+            },
+            ..Default::default()
+        }))
+        .unwrap_err();
+        assert_policy_err_contains(err, "proxy");
+    }
+
+    // ===== filesystem =====
+
+    #[test]
+    fn readwrite_and_readonly_paths_become_mapped_folders() {
+        let rw = tempfile::tempdir().unwrap();
+        let ro = tempfile::tempdir().unwrap();
+        let plan = plan_policy(&request_with(ContainerPolicy {
+            readwrite_paths: vec![rw.path().to_string_lossy().into_owned()],
+            readonly_paths: vec![ro.path().to_string_lossy().into_owned()],
+            ..Default::default()
+        }))
+        .unwrap();
+        assert_eq!(plan.mapped_folders.len(), 2);
+        let rw_folder = plan.mapped_folders.iter().find(|f| !f.read_only).unwrap();
+        let ro_folder = plan.mapped_folders.iter().find(|f| f.read_only).unwrap();
+        // Host parity: sandbox path equals host path.
+        assert_eq!(rw_folder.host, rw_folder.sandbox);
+        assert_eq!(ro_folder.host, ro_folder.sandbox);
+        // No verbatim prefix leaks into the .wsb value.
+        assert!(!rw_folder.host.starts_with(r"\\?\"));
+    }
+
+    #[test]
+    fn missing_path_rejected() {
+        let err = plan_policy(&request_with(ContainerPolicy {
+            readonly_paths: vec![r"C:\definitely\not\here\xyzzy".to_string()],
+            ..Default::default()
+        }))
+        .unwrap_err();
+        assert_policy_err_contains(err, "does not exist");
+    }
+
+    #[test]
+    fn file_path_rejected() {
+        let dir = tempfile::tempdir().unwrap();
+        let file = dir.path().join("a.txt");
+        std::fs::write(&file, b"x").unwrap();
+        let err = plan_policy(&request_with(ContainerPolicy {
+            readonly_paths: vec![file.to_string_lossy().into_owned()],
+            ..Default::default()
+        }))
+        .unwrap_err();
+        assert_policy_err_contains(err, "is a file");
+    }
+
+    #[test]
+    fn conflicting_readonly_flags_rejected() {
+        let dir = tempfile::tempdir().unwrap();
+        let p = dir.path().to_string_lossy().into_owned();
+        let err = plan_policy(&request_with(ContainerPolicy {
+            readwrite_paths: vec![p.clone()],
+            readonly_paths: vec![p],
+            ..Default::default()
+        }))
+        .unwrap_err();
+        assert_policy_err_contains(err, "both read-write and read-only");
+    }
+
+    #[test]
+    fn duplicate_same_access_collapses() {
+        let dir = tempfile::tempdir().unwrap();
+        let p = dir.path().to_string_lossy().into_owned();
+        let plan = plan_policy(&request_with(ContainerPolicy {
+            readwrite_paths: vec![p.clone(), p],
+            ..Default::default()
+        }))
+        .unwrap();
+        assert_eq!(plan.mapped_folders.len(), 1);
+    }
+
+    #[test]
+    fn nested_mapped_paths_rejected() {
+        let parent = tempfile::tempdir().unwrap();
+        let child = parent.path().join("child");
+        std::fs::create_dir(&child).unwrap();
+        let err = plan_policy(&request_with(ContainerPolicy {
+            readwrite_paths: vec![parent.path().to_string_lossy().into_owned()],
+            readonly_paths: vec![child.to_string_lossy().into_owned()],
+            ..Default::default()
+        }))
+        .unwrap_err();
+        assert_policy_err_contains(err, "overlaps");
+    }
+
+    // ===== denied paths =====
+
+    #[test]
+    fn denied_outside_shares_is_noop() {
+        let dir = tempfile::tempdir().unwrap();
+        let plan = plan_policy(&request_with(ContainerPolicy {
+            readwrite_paths: vec![dir.path().to_string_lossy().into_owned()],
+            denied_paths: vec![r"C:\some\unrelated\secret".to_string()],
+            ..Default::default()
+        }))
+        .unwrap();
+        assert_eq!(plan.mapped_folders.len(), 1);
+    }
+
+    #[test]
+    fn denied_equal_to_mapped_share_rejected() {
+        let dir = tempfile::tempdir().unwrap();
+        let p = dir.path().to_string_lossy().into_owned();
+        let err = plan_policy(&request_with(ContainerPolicy {
+            readwrite_paths: vec![p.clone()],
+            denied_paths: vec![p],
+            ..Default::default()
+        }))
+        .unwrap_err();
+        assert_policy_err_contains(err, "same as mapped share");
+    }
+
+    #[test]
+    fn denied_inside_mapped_share_rejected() {
+        let dir = tempfile::tempdir().unwrap();
+        let inside = format!("{}\\secret", dir.path().to_string_lossy());
+        let err = plan_policy(&request_with(ContainerPolicy {
+            readwrite_paths: vec![dir.path().to_string_lossy().into_owned()],
+            denied_paths: vec![inside],
+            ..Default::default()
+        }))
+        .unwrap_err();
+        assert_policy_err_contains(err, "inside mapped share");
+    }
+
+    #[test]
+    fn denied_ancestor_of_mapped_share_rejected() {
+        // A denied path that *contains* a mapped share is unenforceable: the
+        // share remains reachable through the mapping despite the denial.
+        let parent = tempfile::tempdir().unwrap();
+        let child = parent.path().join("child");
+        std::fs::create_dir(&child).unwrap();
+        let err = plan_policy(&request_with(ContainerPolicy {
+            readwrite_paths: vec![child.to_string_lossy().into_owned()],
+            denied_paths: vec![parent.path().to_string_lossy().into_owned()],
+            ..Default::default()
+        }))
+        .unwrap_err();
+        assert_policy_err_contains(err, "contains mapped share");
+    }
+
+    #[test]
+    fn denied_relative_path_rejected() {
+        let dir = tempfile::tempdir().unwrap();
+        let err = plan_policy(&request_with(ContainerPolicy {
+            readwrite_paths: vec![dir.path().to_string_lossy().into_owned()],
+            denied_paths: vec![r"relative\secret".to_string()],
+            ..Default::default()
+        }))
+        .unwrap_err();
+        assert_policy_err_contains(err, "absolute");
+    }
+
+    #[test]
+    fn denied_equal_share_matches_through_case_and_separator() {
+        // The same existing directory written with different case and forward
+        // slashes must still be recognised as the mapped share (canonicalized,
+        // case-folded comparison), not slip past as a no-op.
+        let dir = tempfile::tempdir().unwrap();
+        let mapped = dir.path().to_string_lossy().into_owned();
+        let denied = mapped.replace('\\', "/").to_uppercase();
+        let err = plan_policy(&request_with(ContainerPolicy {
+            readwrite_paths: vec![mapped],
+            denied_paths: vec![denied],
+            ..Default::default()
+        }))
+        .unwrap_err();
+        assert_policy_err_contains(err, "same as mapped share");
+    }
+
+    #[test]
+    fn denied_nonexistent_outside_share_under_real_ancestor_is_noop() {
+        // A denied leaf that does not exist but whose existing ancestor is
+        // unrelated to any mapped share remains a no-op.
+        let mapped = tempfile::tempdir().unwrap();
+        let other = tempfile::tempdir().unwrap();
+        let denied = format!("{}\\ghost\\leaf", other.path().to_string_lossy());
+        let plan = plan_policy(&request_with(ContainerPolicy {
+            readwrite_paths: vec![mapped.path().to_string_lossy().into_owned()],
+            denied_paths: vec![denied],
+            ..Default::default()
+        }))
+        .unwrap();
+        assert_eq!(plan.mapped_folders.len(), 1);
+    }
+
+    // ===== component helpers =====
+
+    #[test]
+    fn path_components_are_case_insensitive_and_normalized() {
+        assert_eq!(
+            path_components(r"C:\Foo\Bar"),
+            path_components(r"c:/foo/bar/")
+        );
+        assert_eq!(
+            path_components(r"C:\foo\.\bar"),
+            path_components(r"C:\foo\bar")
+        );
+        assert_eq!(
+            path_components(r"C:\foo\baz\..\bar"),
+            path_components(r"C:\foo\bar")
+        );
+    }
+
+    #[test]
+    fn is_descendant_avoids_prefix_false_positive() {
+        let foobar = path_components(r"C:\foobar");
+        let foo = path_components(r"C:\foo");
+        assert!(!is_descendant(&foobar, &foo));
+        let foo_child = path_components(r"C:\foo\child");
+        assert!(is_descendant(&foo_child, &foo));
+        // Equal is not a descendant.
+        assert!(!is_descendant(&foo, &foo));
+    }
+
+    #[test]
+    fn strip_verbatim_prefix_handles_drive_and_unc() {
+        assert_eq!(strip_verbatim_prefix(r"\\?\C:\foo"), r"C:\foo");
+        assert_eq!(
+            strip_verbatim_prefix(r"\\?\UNC\server\share"),
+            r"\\server\share"
+        );
+        assert_eq!(strip_verbatim_prefix(r"C:\foo"), r"C:\foo");
+    }
+}
diff --git a/src/backends/windows_sandbox/lifecycle/src/rendezvous.rs b/src/backends/windows_sandbox/lifecycle/src/rendezvous.rs
new file mode 100644
index 000000000..662f3cc6d
--- /dev/null
+++ b/src/backends/windows_sandbox/lifecycle/src/rendezvous.rs
@@ -0,0 +1,105 @@
+//! Rendezvous file polling.
+//!
+//! The guest agent writes `<ip>:<port>` to a file in a MappedFolder.
+//! We poll until the file appears and contains a valid address.
+
+use std::net::SocketAddr;
+use std::path::Path;
+use std::time::Duration;
+
+use anyhow::{Context, Result};
+
+/// Maximum time to wait for the guest agent's rendezvous file.
+pub const RENDEZVOUS_TIMEOUT: Duration = Duration::from_secs(360);
+
+pub const RENDEZVOUS_POLL_INTERVAL: Duration = Duration::from_millis(500);
+
+/// Maximum time to wait for TCP connect after rendezvous.
+pub const GUEST_CONNECT_TIMEOUT: Duration = Duration::from_secs(30);
+
+/// Poll `rendezvous_dir/rendezvous.txt` until it contains a valid `ip:port`.
+pub async fn wait_for_rendezvous(
+    rendezvous_dir: &Path,
+    timeout: std::time::Duration,
+    poll_interval: std::time::Duration,
+) -> Result<SocketAddr> {
+    let file_path = rendezvous_dir.join("rendezvous.txt");
+    let deadline = tokio::time::Instant::now() + timeout;
+
+    loop {
+        if tokio::time::Instant::now() >= deadline {
+            anyhow::bail!(
+                "timed out waiting for rendezvous file {:?} after {:?}",
+                file_path,
+                timeout
+            );
+        }
+
+        if file_path.exists() {
+            if let Ok(content) = tokio::fs::read_to_string(&file_path).await {
+                let trimmed = content.trim();
+                if let Ok(addr) = trimmed.parse::<SocketAddr>() {
+                    eprintln!("[daemon] rendezvous: guest at {}", addr);
+                    return Ok(addr);
+                }
+            }
+        }
+
+        tokio::time::sleep(poll_interval).await;
+    }
+}
+
+/// Delete the rendezvous file so a fresh sandbox will write a new one.
+pub async fn cleanup(rendezvous_dir: &Path) -> Result<()> {
+    let file_path = rendezvous_dir.join("rendezvous.txt");
+    if file_path.exists() {
+        tokio::fs::remove_file(&file_path)
+            .await
+            .with_context(|| format!("delete rendezvous file {:?}", file_path))?;
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::time::Duration;
+
+    #[tokio::test]
+    async fn wait_for_rendezvous_success() {
+        let dir = tempfile::tempdir().unwrap();
+
+        // Write a valid address after a short delay.
+        let dir_path = dir.path().to_path_buf();
+        tokio::spawn(async move {
+            tokio::time::sleep(Duration::from_millis(50)).await;
+            tokio::fs::write(dir_path.join("rendezvous.txt"), "192.168.1.100:12345")
+                .await
+                .unwrap();
+        });
+
+        let addr = wait_for_rendezvous(
+            dir.path(),
+            Duration::from_secs(5),
+            Duration::from_millis(20),
+        )
+        .await
+        .unwrap();
+
+        assert_eq!(addr, "192.168.1.100:12345".parse().unwrap());
+    }
+
+    #[tokio::test]
+    async fn wait_for_rendezvous_timeout() {
+        let dir = tempfile::tempdir().unwrap();
+
+        let result = wait_for_rendezvous(
+            dir.path(),
+            Duration::from_millis(100),
+            Duration::from_millis(20),
+        )
+        .await;
+
+        assert!(result.is_err());
+    }
+}
diff --git a/src/backends/windows_sandbox/lifecycle/src/teardown.rs b/src/backends/windows_sandbox/lifecycle/src/teardown.rs
new file mode 100644
index 000000000..500fc7c5e
--- /dev/null
+++ b/src/backends/windows_sandbox/lifecycle/src/teardown.rs
@@ -0,0 +1,889 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Ownership-scoped teardown for the transient one-shot Windows Sandbox runner.
+//!
+//! A one-shot run tears down only VM host processes it can prove it launched.
+//! The guard, console handler, and crash-reclaim marker all share the same
+//! ownership state so foreign/manual sandboxes are not disturbed.
+
+use std::path::{Path, PathBuf};
+use std::sync::{Mutex, Once, OnceLock};
+use std::time::{Duration, Instant};
+
+use serde::{Deserialize, Serialize};
+
+use crate::control_plane::{
+    enumerate_processes_with_prefix, plan_kill_set, process_creation_time,
+    running_process_creation_time, terminate_processes, TeardownOutcome, VmOwnership, VmProcId,
+};
+
+/// Prefix shared by Windows Sandbox host processes.
+const WSB_PROCESS_PREFIX: &str = "WindowsSandbox";
+
+const MARKERS_SUBDIR: &str = "wxc-wsb";
+
+const ONESHOT_SUBDIR: &str = "oneshot";
+
+const MARKER_FILE: &str = "oneshot.marker";
+
+const TEARDOWN_POLL_TIMEOUT: Duration = Duration::from_secs(30);
+
+const TEARDOWN_PANIC_POLL_TIMEOUT: Duration = Duration::from_secs(8);
+
+const TEARDOWN_POLL_INTERVAL: Duration = Duration::from_millis(750);
+
+const HANDLER_SLOT_WAIT: Duration = Duration::from_secs(5);
+
+const GC_MIN_AGE: Duration = Duration::from_secs(120);
+
+/// Outcome of reconciling the host single-instance slot before a launch.
+#[derive(Debug)]
+pub(crate) enum Reconcile {
+    Proceed(Option<String>),
+    Busy(String),
+}
+
+/// Per-run marker used for crash recovery.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct OneShotMarker {
+    /// PID of the `wxc-exec` process that owns this run.
+    launcher_pid: u32,
+    /// Creation time of `launcher_pid`; paired with PID to defeat reuse.
+    #[serde(default)]
+    launcher_creation_time: Option<u64>,
+    /// Positive ownership proof captured after launch.
+    #[serde(default)]
+    vm_processes: Vec<VmProcId>,
+}
+
+/// Per-marker state consumed by [`classify_reconcile`].
+#[derive(Debug, Clone)]
+struct MarkerState {
+    launcher_strongly_alive: bool,
+    vm_processes: Vec<VmProcId>,
+}
+
+/// Why a reconcile refused to launch.
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum BusyReason {
+    /// The liveness probe itself failed; we cannot prove the slot is free.
+    ProbeFailed,
+    /// Another disposable run is active (a strongly-live launcher).
+    ActiveRun,
+    /// A VM is running but no marker positively proves we own it.
+    ForeignUnprovable,
+}
+
+impl BusyReason {
+    fn message(&self) -> String {
+        match self {
+            BusyReason::ProbeFailed => {
+                "could not determine whether a Windows Sandbox VM is running".to_string()
+            }
+            BusyReason::ActiveRun => "another disposable Windows Sandbox run is active".to_string(),
+            BusyReason::ForeignUnprovable => {
+                "a Windows Sandbox VM is running that this run cannot prove it owns".to_string()
+            }
+        }
+    }
+}
+
+/// Pure reconcile decision, derived from the probe result, the live VM process
+/// set, and the per-marker states so it is unit-testable without a real VM.
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum ReconcileDecision {
+    /// No VM is running: launch normally (caller cleans dead-launcher dirs).
+    Proceed,
+    /// Reclaim an orphan using prior recorded proof, never the live snapshot.
+    ReclaimThenProceed { proof: Vec<VmProcId> },
+    /// Refuse to launch.
+    Busy(BusyReason),
+}
+
+/// Decide what to do about the host single-instance VM slot before launching.
+///
+/// Launcher liveness is intentionally *strong* (PID + creation time both
+/// match). A marker whose launcher is dead-or-unknown must never block a
+/// proof-based reclaim, which is what avoids a recycled-PID wedge.
+///
+/// Reclaim is authorised only by prior proof intersecting the live snapshot;
+/// the snapshot itself must never become proof.
+/// Probe failure and a live launcher take precedence over reclaim.
+fn classify_reconcile(
+    running: Option<bool>,
+    current_vm: &[VmProcId],
+    markers: &[MarkerState],
+) -> ReconcileDecision {
+    let running = match running {
+        None => return ReconcileDecision::Busy(BusyReason::ProbeFailed),
+        Some(r) => r,
+    };
+    if !running {
+        return ReconcileDecision::Proceed;
+    }
+    if markers.iter().any(|m| m.launcher_strongly_alive) {
+        return ReconcileDecision::Busy(BusyReason::ActiveRun);
+    }
+    // Collect all recorded proofs that intersect the live set. The live
+    // snapshot must not be promoted into ownership proof.
+    let mut proof: Vec<VmProcId> = Vec::new();
+    let mut any_intersect = false;
+    for marker in markers {
+        let intersects = marker.vm_processes.iter().any(|p| current_vm.contains(p));
+        if intersects {
+            any_intersect = true;
+            for p in &marker.vm_processes {
+                if !proof.contains(p) {
+                    proof.push(*p);
+                }
+            }
+        }
+    }
+    if any_intersect {
+        ReconcileDecision::ReclaimThenProceed { proof }
+    } else {
+        ReconcileDecision::Busy(BusyReason::ForeignUnprovable)
+    }
+}
+
+/// Ownership and scratch state used by process-exit teardown.
+#[derive(Debug)]
+struct OneShotTeardown {
+    run_dir: PathBuf,
+    ownership: VmOwnership,
+}
+
+impl OneShotTeardown {
+    /// Tear down owned processes and clear the marker only after confirmed exit.
+    fn full(&self, poll_budget: Duration) {
+        let snapshot = enumerate_processes_with_prefix(WSB_PROCESS_PREFIX).unwrap_or_default();
+        let plan = plan_kill_set(&self.ownership, &snapshot);
+        match plan {
+            None => {
+                match &self.ownership {
+                    VmOwnership::NotLaunched | VmOwnership::LaunchSucceededNoProof => {
+                        clear_marker_dir(&self.run_dir);
+                    }
+                    VmOwnership::LaunchInFlight => {
+                        // Preserve ambiguous ownership for the next reconcile.
+                    }
+                    VmOwnership::Owned(_) => {
+                        // plan_kill_set(Owned, _) is always Some.
+                        unreachable!("Owned with any snapshot always returns Some kill plan");
+                    }
+                }
+            }
+            Some(kill_set) => match teardown_owned_blocking(&kill_set, poll_budget) {
+                TeardownOutcome::ConfirmedGone => {
+                    clear_marker_dir(&self.run_dir);
+                }
+                TeardownOutcome::StillRunning(_) | TeardownOutcome::ProbeFailed => {}
+            },
+        }
+    }
+
+    /// Issue scoped process termination without waiting for console shutdown.
+    fn kill_only(&self) {
+        let snapshot = enumerate_processes_with_prefix(WSB_PROCESS_PREFIX).unwrap_or_default();
+        if let Some(kill_set) = plan_kill_set(&self.ownership, &snapshot) {
+            terminate_processes(&kill_set);
+        }
+    }
+}
+
+/// Process-global take-once slot shared by the stack guard and the console
+/// handler so the VM is torn down at most once.
+static TEARDOWN_SLOT: OnceLock<Mutex<Option<OneShotTeardown>>> = OnceLock::new();
+
+fn slot() -> &'static Mutex<Option<OneShotTeardown>> {
+    TEARDOWN_SLOT.get_or_init(|| Mutex::new(None))
+}
+
+/// Take the parked teardown payload (if any). Returns `None` if nothing was
+/// parked or the other path already took it. Recovers from a poisoned mutex so
+/// a panic on one path cannot strand the payload (which would leak the VM).
+fn take_parked() -> Option<OneShotTeardown> {
+    TEARDOWN_SLOT.get().and_then(|s| {
+        let mut guard = s.lock().unwrap_or_else(|p| p.into_inner());
+        guard.take()
+    })
+}
+
+/// Update the parked payload's [`VmOwnership`]. Called by the one-shot runner
+/// as the launch progresses (arm → `LaunchInFlight` → `LaunchSucceededNoProof`
+/// → `Owned`). The critical section is tiny — it performs no I/O, no awaits,
+/// and no marker rewrite while the slot mutex is held — so it cannot deadlock
+/// the guard or the console handler.
+pub(crate) fn set_vm_ownership(ownership: VmOwnership) {
+    if let Some(s) = TEARDOWN_SLOT.get() {
+        let mut guard = s.lock().unwrap_or_else(|p| p.into_inner());
+        if let Some(token) = guard.as_mut() {
+            token.ownership = ownership;
+        }
+    }
+}
+
+/// Root directory holding per-run one-shot scratch directories.
+pub(crate) fn markers_root() -> PathBuf {
+    std::env::temp_dir()
+        .join(MARKERS_SUBDIR)
+        .join(ONESHOT_SUBDIR)
+}
+
+/// Secure and ownership-verify the marker root before trusting recorded VM
+/// ownership proof. This prevents a forged cross-user marker authorising
+/// teardown of a foreign VM.
+pub(crate) fn secure_markers_root() -> anyhow::Result<()> {
+    crate::control_plane::ensure_secure_dir(&markers_root())
+}
+
+/// Atomically write `marker` into `run_dir` (temp file + rename) so a crash
+/// mid-write cannot leave a half-written, unparseable marker.
+fn write_marker_struct(run_dir: &Path, marker: &OneShotMarker) -> std::io::Result<()> {
+    let path = run_dir.join(MARKER_FILE);
+    let tmp = run_dir.join(format!("{MARKER_FILE}.tmp"));
+    let bytes = serde_json::to_vec(marker)
+        .map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, e))?;
+    std::fs::write(&tmp, bytes)?;
+    std::fs::rename(&tmp, &path)
+}
+
+/// Write launcher identity before launch; VM proof is added after launch.
+///
+/// # Errors
+/// Returns the underlying I/O error if the marker cannot be written.
+pub(crate) fn write_marker(run_dir: &Path) -> std::io::Result<()> {
+    let pid = std::process::id();
+    let marker = OneShotMarker {
+        launcher_pid: pid,
+        launcher_creation_time: process_creation_time(pid),
+        vm_processes: Vec::new(),
+    };
+    write_marker_struct(run_dir, &marker)
+}
+
+/// Add VM-ownership proof before waiting for guest rendezvous.
+///
+/// # Errors
+/// Returns the underlying I/O error if the marker cannot be rewritten.
+pub(crate) fn rewrite_marker_with_proof(
+    run_dir: &Path,
+    vm_processes: &[VmProcId],
+) -> std::io::Result<()> {
+    let pid = std::process::id();
+    let marker = OneShotMarker {
+        launcher_pid: pid,
+        launcher_creation_time: process_creation_time(pid),
+        vm_processes: vm_processes.to_vec(),
+    };
+    write_marker_struct(run_dir, &marker)
+}
+
+/// Read and parse a per-run directory's marker, if present and well-formed.
+fn read_marker(run_dir: &Path) -> Option<OneShotMarker> {
+    let bytes = std::fs::read(run_dir.join(MARKER_FILE)).ok()?;
+    serde_json::from_slice(&bytes).ok()
+}
+
+/// Whether the launcher is running with the recorded creation time.
+///
+/// Both checks are required: retained handles keep exited processes queryable,
+/// while creation time prevents PID reuse from impersonating the launcher.
+fn launcher_strongly_alive(marker: &OneShotMarker) -> bool {
+    match marker.launcher_creation_time {
+        Some(ct) => running_process_creation_time(marker.launcher_pid) == Some(ct),
+        None => false,
+    }
+}
+
+/// Remove the marker before best-effort scratch cleanup so a directory retained
+/// by lingering VM handles cannot be mistaken for a reclaimable run.
+fn clear_marker_dir(run_dir: &Path) {
+    let _ = std::fs::remove_file(run_dir.join(MARKER_FILE));
+    let _ = std::fs::remove_dir_all(run_dir);
+}
+
+/// List per-run scratch directories under `markers_root` that carry the
+/// disposable-run marker.
+fn list_marker_dirs(root: &Path) -> Vec<PathBuf> {
+    let mut dirs = Vec::new();
+    let Ok(entries) = std::fs::read_dir(root) else {
+        return dirs;
+    };
+    for entry in entries.flatten() {
+        let path = entry.path();
+        if path.is_dir() && path.join(MARKER_FILE).exists() {
+            dirs.push(path);
+        }
+    }
+    dirs
+}
+
+/// Garbage-collect old markerless scratch directories once VM handles release.
+///
+/// Young directories are skipped so a peer between directory creation and
+/// marker creation is never removed.
+pub(crate) fn gc_orphan_scratch_dirs(root: &Path) {
+    gc_orphan_scratch_dirs_with_age(root, GC_MIN_AGE);
+}
+
+fn gc_orphan_scratch_dirs_with_age(root: &Path, min_age: Duration) {
+    let Ok(entries) = std::fs::read_dir(root) else {
+        return;
+    };
+    for entry in entries.flatten() {
+        let path = entry.path();
+        if path.is_dir() && !path.join(MARKER_FILE).exists() && dir_older_than(&path, min_age) {
+            let _ = std::fs::remove_dir_all(&path);
+        }
+    }
+}
+
+/// Whether `path`'s last-modified time is at least `min_age` in the past.
+/// On any metadata/clock error the directory is treated as *too young* to
+/// remove, erring toward leaving litter rather than deleting a live peer's
+/// directory.
+fn dir_older_than(path: &Path, min_age: Duration) -> bool {
+    std::fs::metadata(path)
+        .and_then(|m| m.modified())
+        .ok()
+        .and_then(|mtime| mtime.elapsed().ok())
+        .map(|age| age >= min_age)
+        .unwrap_or(false)
+}
+
+/// Reconcile the host single-instance slot before launching a disposable VM.
+///
+/// Reclaim only when recorded proof intersects the live process set. A live
+/// launcher or unproven VM is treated as foreign and left untouched.
+pub(crate) fn reconcile_existing_vm(root: &Path) -> Reconcile {
+    let running = wsb_vm_running();
+
+    // Fail closed: an empty fallback could launch over an existing singleton VM.
+    let current_vm = match enumerate_processes_with_prefix(WSB_PROCESS_PREFIX) {
+        Ok(v) => v,
+        Err(e) => {
+            return Reconcile::Busy(format!(
+                "could not enumerate WindowsSandbox host processes (Toolhelp32 snapshot \
+                 failed: {e}); refusing to launch a new VM because doing so on top of an \
+                 unknown live VM would violate the host single-instance constraint. Retry; \
+                 if persistent, restart the Windows Sandbox service."
+            ));
+        }
+    };
+
+    let marker_dirs = list_marker_dirs(root);
+    let mut states: Vec<MarkerState> = Vec::with_capacity(marker_dirs.len());
+    let mut dead_dirs: Vec<PathBuf> = Vec::new();
+    for dir in &marker_dirs {
+        match read_marker(dir) {
+            Some(marker) => {
+                let alive = launcher_strongly_alive(&marker);
+                if !alive {
+                    dead_dirs.push(dir.clone());
+                }
+                states.push(MarkerState {
+                    launcher_strongly_alive: alive,
+                    vm_processes: marker.vm_processes,
+                });
+            }
+            None => {
+                // Unparseable / absent marker: a dead launcher with no proof.
+                dead_dirs.push(dir.clone());
+                states.push(MarkerState {
+                    launcher_strongly_alive: false,
+                    vm_processes: Vec::new(),
+                });
+            }
+        }
+    }
+
+    if std::env::var_os("WXC_WSB_RECONCILE_DEBUG").is_some() {
+        eprintln!(
+            "[one-shot][reconcile-debug] running={running:?} current_vm={current_vm:?} \
+             marker_dirs={} states={states:?}",
+            marker_dirs.len()
+        );
+        for dir in &marker_dirs {
+            eprintln!(
+                "[one-shot][reconcile-debug]   dir={} marker={:?}",
+                dir.display(),
+                read_marker(dir)
+            );
+        }
+    }
+
+    match classify_reconcile(running, &current_vm, &states) {
+        ReconcileDecision::Busy(reason) => Reconcile::Busy(reason.message()),
+        ReconcileDecision::Proceed => {
+            // No VM: clean dead-launcher dirs only. A strongly-live launcher dir
+            // with no VM is a peer mid-launch; leave it alone.
+            for dir in &dead_dirs {
+                clear_marker_dir(dir);
+            }
+            Reconcile::Proceed(None)
+        }
+        ReconcileDecision::ReclaimThenProceed { proof } => {
+            eprintln!(
+                "[one-shot] warning: reclaiming an orphaned disposable Windows Sandbox VM \
+                 (found {} stale marker dir(s), {} recorded host process identity/identities \
+                 from intersecting markers)",
+                dead_dirs.len(),
+                proof.len()
+            );
+            // Seed kill via plan_kill_set with the RECORDED proof (not the
+            // live snapshot). Same reasoning as the daemon's startup reclaim:
+            // an intersection check on (proof, snapshot) ensures any foreign
+            // WindowsSandbox* process visible at reconcile time is excluded
+            // from the kill set. Seeding with `current_vm` (the live snapshot)
+            // instead would let a foreign VM be promoted into the kill set.
+            let kill_plan =
+                plan_kill_set(&VmOwnership::Owned(proof), &current_vm).unwrap_or_default();
+            match teardown_owned_blocking(&kill_plan, TEARDOWN_POLL_TIMEOUT) {
+                TeardownOutcome::ConfirmedGone => {
+                    for dir in &dead_dirs {
+                        clear_marker_dir(dir);
+                    }
+                    Reconcile::Proceed(Some(format!(
+                        "reclaimed an orphaned disposable Windows Sandbox VM from a prior run \
+                         ({} stale marker dir(s) cleaned)",
+                        dead_dirs.len()
+                    )))
+                }
+                TeardownOutcome::StillRunning(remaining) => Reconcile::Busy(format!(
+                    "failed to tear down an orphaned disposable Windows Sandbox VM ({} host \
+                     process(es) still alive: {:?})",
+                    remaining.len(),
+                    remaining
+                )),
+                TeardownOutcome::ProbeFailed => Reconcile::Busy(
+                    "failed to tear down an orphaned disposable Windows Sandbox VM (liveness \
+                     probe failed)"
+                        .to_string(),
+                ),
+            }
+        }
+    }
+}
+
+/// Check whether any Windows Sandbox host process is currently running.
+///
+/// Excludes lingering `vmmem*` processes that do not block a fresh launch.
+/// Returns `None` when the probe fails.
+fn wsb_vm_running() -> Option<bool> {
+    // Toolhelp32 snapshot (no PowerShell). A snapshot failure is surfaced as
+    // `None` so the ambiguity is visible to callers.
+    crate::control_plane::enumerate_pids_with_prefix(WSB_PROCESS_PREFIX)
+        .ok()
+        .map(|pids| !pids.is_empty())
+}
+
+/// Apply an upstream ownership-scoped kill plan and wait for host processes to
+/// exit. Markers may be cleared only on [`TeardownOutcome::ConfirmedGone`].
+fn teardown_owned_blocking(kill_set: &[VmProcId], poll_budget: Duration) -> TeardownOutcome {
+    terminate_processes(kill_set);
+
+    let deadline = Instant::now() + poll_budget;
+    loop {
+        match wsb_vm_running() {
+            Some(false) => return TeardownOutcome::ConfirmedGone,
+            Some(true) => {
+                if Instant::now() >= deadline {
+                    let remaining =
+                        enumerate_processes_with_prefix(WSB_PROCESS_PREFIX).unwrap_or_default();
+                    eprintln!(
+                        "[one-shot] warning: {} Windows Sandbox host process(es) still running \
+                         after scoped teardown wait",
+                        remaining.len()
+                    );
+                    return TeardownOutcome::StillRunning(remaining);
+                }
+            }
+            None => {
+                if Instant::now() >= deadline {
+                    eprintln!(
+                        "[one-shot] warning: liveness probe failed during teardown wait; \
+                         preserving marker"
+                    );
+                    return TeardownOutcome::ProbeFailed;
+                }
+            }
+        }
+        std::thread::sleep(TEARDOWN_POLL_INTERVAL);
+    }
+}
+
+/// Stack-owned witness that guarantees the disposable VM is torn down on every
+/// normal-return and panic-unwind path out of the one-shot runner.
+///
+/// Construct it via [`VmTeardownGuard::arm`] *immediately before* launching the
+/// VM. `Drop` is best-effort and never panics (it may run while unwinding).
+#[derive(Debug)]
+pub(crate) struct VmTeardownGuard;
+
+impl VmTeardownGuard {
+    /// Arm one-shot teardown and return the stack guard.
+    ///
+    /// Parks a teardown payload for `run_dir` so the console handler can fire
+    /// it, and installs the console-control handler (once per process). Must be
+    /// called only by the one-shot runner — installing the handler makes Ctrl-C
+    /// tear down a running VM, which is correct only for disposable runs.
+    pub(crate) fn arm(run_dir: PathBuf) -> Self {
+        {
+            let mut guard = slot().lock().unwrap_or_else(|p| p.into_inner());
+            *guard = Some(OneShotTeardown {
+                run_dir,
+                ownership: VmOwnership::NotLaunched,
+            });
+        }
+        install_ctrl_handler();
+        Self
+    }
+}
+
+impl Drop for VmTeardownGuard {
+    fn drop(&mut self) {
+        let budget = if std::thread::panicking() {
+            TEARDOWN_PANIC_POLL_TIMEOUT
+        } else {
+            TEARDOWN_POLL_TIMEOUT
+        };
+        if let Some(token) = take_parked() {
+            token.full(budget);
+        }
+    }
+}
+
+/// Console handler for shutdown paths that skip Rust destructors.
+///
+/// It takes the parked payload, issues termination without waiting, and returns
+/// `FALSE` so the default process-termination handler still runs.
+/// The slot lock is released before termination begins.
+unsafe extern "system" fn wsb_ctrl_handler(_ctrl_type: u32) -> windows::core::BOOL {
+    let taken = TEARDOWN_SLOT.get().and_then(|s| {
+        let deadline = Instant::now() + HANDLER_SLOT_WAIT;
+        loop {
+            if let Ok(mut guard) = s.try_lock() {
+                break guard.take();
+            }
+            if Instant::now() >= deadline {
+                break None;
+            }
+            std::thread::sleep(Duration::from_millis(50));
+        }
+    });
+    if let Some(token) = taken {
+        token.kill_only();
+    }
+    // FALSE = "not fully handled; run the next handler (the default one that
+    // calls ExitProcess)".
+    windows::core::BOOL(0)
+}
+
+/// Install the console-control handler once per process.
+fn install_ctrl_handler() {
+    use windows::Win32::System::Console::SetConsoleCtrlHandler;
+    static ONCE: Once = Once::new();
+    ONCE.call_once(|| {
+        // SAFETY: `wsb_ctrl_handler` has the correct `extern "system"` ABI;
+        // `Add = TRUE` merely appends to the OS handler chain.
+        let _ = unsafe { SetConsoleCtrlHandler(Some(wsb_ctrl_handler), true) };
+    });
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn list_marker_dirs_finds_only_marked_dirs() {
+        let root = tempfile::tempdir().unwrap();
+        let marked = root.path().join("run-a");
+        let unmarked = root.path().join("run-b");
+        std::fs::create_dir_all(&marked).unwrap();
+        std::fs::create_dir_all(&unmarked).unwrap();
+        write_marker(&marked).unwrap();
+
+        let found = list_marker_dirs(root.path());
+        assert_eq!(found.len(), 1);
+        assert_eq!(found[0], marked);
+    }
+
+    #[test]
+    fn list_marker_dirs_empty_for_missing_root() {
+        let root = tempfile::tempdir().unwrap();
+        let missing = root.path().join("does-not-exist");
+        assert!(list_marker_dirs(&missing).is_empty());
+    }
+
+    #[test]
+    fn write_marker_creates_marker_file() {
+        let dir = tempfile::tempdir().unwrap();
+        write_marker(dir.path()).unwrap();
+        assert!(dir.path().join(MARKER_FILE).exists());
+    }
+
+    #[test]
+    fn write_then_read_marker_round_trips_identity() {
+        let dir = tempfile::tempdir().unwrap();
+        write_marker(dir.path()).unwrap();
+        let marker = read_marker(dir.path()).expect("marker should parse");
+        assert_eq!(marker.launcher_pid, std::process::id());
+        assert!(marker.vm_processes.is_empty());
+    }
+
+    #[test]
+    fn read_marker_none_when_absent() {
+        let dir = tempfile::tempdir().unwrap();
+        assert!(read_marker(dir.path()).is_none());
+    }
+
+    #[test]
+    fn rewrite_marker_preserves_launcher_and_adds_proof() {
+        let dir = tempfile::tempdir().unwrap();
+        write_marker(dir.path()).unwrap();
+        let proof = vec![
+            VmProcId {
+                pid: 1234,
+                creation_time: 42,
+            },
+            VmProcId {
+                pid: 5678,
+                creation_time: 99,
+            },
+        ];
+        rewrite_marker_with_proof(dir.path(), &proof).unwrap();
+        let marker = read_marker(dir.path()).expect("marker should parse");
+        assert_eq!(marker.launcher_pid, std::process::id());
+        assert_eq!(marker.vm_processes, proof);
+    }
+
+    #[test]
+    fn legacy_text_marker_is_unparseable() {
+        // A pre-JSON `pid=N` marker must not parse (treated as a dead launcher
+        // with no proof), never as a live launcher.
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::write(dir.path().join(MARKER_FILE), "pid=1234\n").unwrap();
+        assert!(read_marker(dir.path()).is_none());
+    }
+
+    #[test]
+    fn clear_marker_dir_removes_dir_and_marker() {
+        let root = tempfile::tempdir().unwrap();
+        let run = root.path().join("run-x");
+        std::fs::create_dir_all(&run).unwrap();
+        write_marker(&run).unwrap();
+        clear_marker_dir(&run);
+        assert!(!run.exists());
+    }
+
+    /// Serialises the few tests that arm the process-global [`VmTeardownGuard`]
+    /// (which mutates the single [`TEARDOWN_SLOT`]) so they cannot race.
+    static GUARD_TEST_LOCK: Mutex<()> = Mutex::new(());
+
+    #[test]
+    fn teardown_guard_drop_runs_teardown_on_post_arm_failure() {
+        // Arming the guard then failing *after* the arm (here: never
+        // advancing past the default `NotLaunched` ownership and dropping the
+        // guard, exactly as `run_one_shot` does when `drive` returns Err or
+        // panics) must still run teardown. With `NotLaunched` ownership and no
+        // VM this host launched, `full()` plans no kill and clears the per-run
+        // marker dir -- so a cleared marker is the observable proof the guard's
+        // Drop ran the teardown path (rather than leaking the run dir).
+        let _serialize = GUARD_TEST_LOCK.lock().unwrap_or_else(|p| p.into_inner());
+        let root = tempfile::tempdir().unwrap();
+        let run_dir = root.path().join("run-postarm");
+        std::fs::create_dir_all(&run_dir).unwrap();
+        write_marker(&run_dir).unwrap();
+        assert!(run_dir.join(MARKER_FILE).exists());
+
+        {
+            let _guard = VmTeardownGuard::arm(run_dir.clone());
+            // Simulate a post-arm failure: return/scope-exit without launching
+            // a VM. Ownership stays `NotLaunched`.
+        } // guard drops here -> teardown runs.
+
+        assert!(
+            !run_dir.join(MARKER_FILE).exists(),
+            "VmTeardownGuard::drop must run teardown (clearing the marker) on the post-arm \
+             failure path, not leak the run dir"
+        );
+    }
+
+    #[test]
+    fn teardown_guard_drop_with_launch_in_flight_preserves_marker_for_reclaim() {
+        // Mirror of the above for the ambiguous `LaunchInFlight` state: a launch
+        // was issued but ownership was never proven, so teardown must NOT clear
+        // the marker (it is left for the next run to reconcile rather than
+        // presuming ownership and risking a foreign-VM kill).
+        let _serialize = GUARD_TEST_LOCK.lock().unwrap_or_else(|p| p.into_inner());
+        let root = tempfile::tempdir().unwrap();
+        let run_dir = root.path().join("run-inflight");
+        std::fs::create_dir_all(&run_dir).unwrap();
+        write_marker(&run_dir).unwrap();
+
+        {
+            let _guard = VmTeardownGuard::arm(run_dir.clone());
+            set_vm_ownership(VmOwnership::LaunchInFlight);
+        } // guard drops here.
+
+        assert!(
+            run_dir.join(MARKER_FILE).exists(),
+            "an in-flight (unproven) launch must preserve the marker for reclaim, not clear it"
+        );
+        // Cleanup (the test, not the guard, owns this dir now).
+        let _ = std::fs::remove_dir_all(&run_dir);
+    }
+
+    #[test]
+    fn gc_removes_only_markerless_dirs() {
+        let root = tempfile::tempdir().unwrap();
+        let leftover = root.path().join("finished");
+        let active = root.path().join("active");
+        std::fs::create_dir_all(leftover.join("rendezvous")).unwrap();
+        std::fs::create_dir_all(&active).unwrap();
+        write_marker(&active).unwrap();
+        // Age threshold of zero: any markerless dir is eligible.
+        gc_orphan_scratch_dirs_with_age(root.path(), Duration::ZERO);
+
+        assert!(!leftover.exists(), "markerless leftover should be swept");
+        assert!(active.exists(), "marked dir must be preserved");
+    }
+
+    #[test]
+    fn gc_skips_young_markerless_dirs() {
+        let root = tempfile::tempdir().unwrap();
+        let young = root.path().join("just-created");
+        std::fs::create_dir_all(&young).unwrap();
+        // A large age guard means a freshly created dir is never swept.
+        gc_orphan_scratch_dirs_with_age(root.path(), Duration::from_secs(3600));
+
+        assert!(young.exists(), "a freshly created dir must not be swept");
+    }
+
+    fn proc(pid: u32, ct: u64) -> VmProcId {
+        VmProcId {
+            pid,
+            creation_time: ct,
+        }
+    }
+
+    #[test]
+    fn classify_probe_failure_is_busy() {
+        assert_eq!(
+            classify_reconcile(None, &[], &[]),
+            ReconcileDecision::Busy(BusyReason::ProbeFailed)
+        );
+    }
+
+    #[test]
+    fn classify_no_vm_proceeds() {
+        let markers = [MarkerState {
+            launcher_strongly_alive: false,
+            vm_processes: vec![proc(1, 1)],
+        }];
+        assert_eq!(
+            classify_reconcile(Some(false), &[], &markers),
+            ReconcileDecision::Proceed
+        );
+    }
+
+    #[test]
+    fn classify_live_launcher_is_active_run() {
+        let current = [proc(100, 5)];
+        let markers = [MarkerState {
+            launcher_strongly_alive: true,
+            vm_processes: vec![proc(100, 5)],
+        }];
+        assert_eq!(
+            classify_reconcile(Some(true), &current, &markers),
+            ReconcileDecision::Busy(BusyReason::ActiveRun)
+        );
+    }
+
+    #[test]
+    fn classify_proof_intersection_reclaims_with_recorded_proof() {
+        let current = [proc(100, 5), proc(200, 6)];
+        let markers = [MarkerState {
+            launcher_strongly_alive: false,
+            vm_processes: vec![proc(100, 5)],
+        }];
+        // ReclaimThenProceed carries the PRIOR recorded proof (deduped union
+        // across intersecting markers), NOT the live snapshot. Seeding with
+        // the snapshot would promote any foreign WindowsSandbox* process at
+        // reconcile time into "proof" once plan_kill_set's intersection check
+        // is applied downstream.
+        assert_eq!(
+            classify_reconcile(Some(true), &current, &markers),
+            ReconcileDecision::ReclaimThenProceed {
+                proof: vec![proc(100, 5)]
+            }
+        );
+    }
+
+    #[test]
+    fn classify_proof_intersection_dedupes_across_markers() {
+        // Two intersecting markers (e.g. a multi-process orphan that two prior
+        // launches each partially recorded) - their proofs are unioned with
+        // dedup, never the live snapshot.
+        let shared = proc(100, 5);
+        let extra = proc(101, 6);
+        let foreign = proc(999, 999);
+        let current = [shared, foreign];
+        let markers = [
+            MarkerState {
+                launcher_strongly_alive: false,
+                vm_processes: vec![shared],
+            },
+            MarkerState {
+                launcher_strongly_alive: false,
+                vm_processes: vec![shared, extra],
+            },
+        ];
+        assert_eq!(
+            classify_reconcile(Some(true), &current, &markers),
+            ReconcileDecision::ReclaimThenProceed {
+                proof: vec![shared, extra]
+            }
+        );
+    }
+
+    #[test]
+    fn classify_no_proof_intersection_is_foreign() {
+        let current = [proc(100, 5)];
+        // Recorded proof refers to a different (dead) process instance.
+        let markers = [MarkerState {
+            launcher_strongly_alive: false,
+            vm_processes: vec![proc(999, 1)],
+        }];
+        assert_eq!(
+            classify_reconcile(Some(true), &current, &markers),
+            ReconcileDecision::Busy(BusyReason::ForeignUnprovable)
+        );
+    }
+
+    #[test]
+    fn classify_pid_match_creation_time_diff_is_foreign() {
+        // PID reuse defence: recorded proof has the same PID as a live
+        // process but a different creation_time. Must NOT intersect.
+        let current = [proc(100, 999)];
+        let markers = [MarkerState {
+            launcher_strongly_alive: false,
+            vm_processes: vec![proc(100, 5)],
+        }];
+        assert_eq!(
+            classify_reconcile(Some(true), &current, &markers),
+            ReconcileDecision::Busy(BusyReason::ForeignUnprovable)
+        );
+    }
+
+    #[test]
+    fn classify_running_no_markers_is_foreign() {
+        let current = [proc(100, 5)];
+        assert_eq!(
+            classify_reconcile(Some(true), &current, &[]),
+            ReconcileDecision::Busy(BusyReason::ForeignUnprovable)
+        );
+    }
+}
diff --git a/src/backends/windows_sandbox/lifecycle/src/vm.rs b/src/backends/windows_sandbox/lifecycle/src/vm.rs
new file mode 100644
index 000000000..25c0dbd77
--- /dev/null
+++ b/src/backends/windows_sandbox/lifecycle/src/vm.rs
@@ -0,0 +1,362 @@
+//! Windows Sandbox VM lifecycle management.
+//!
+//! Generates .wsb configuration files and launches/tears down
+//! `WindowsSandbox.exe`.
+
+use std::fmt::Write;
+use std::path::{Path, PathBuf};
+
+use anyhow::{Context, Result};
+use tokio::process::Command;
+
+const SANDBOX_GUEST_DIR: &str = r"C:\Sandbox-Guest";
+
+const SANDBOX_RENDEZVOUS_DIR: &str = r"C:\Sandbox-Rendezvous";
+
+const GUEST_BINARY: &str = "wxc-windows-sandbox-guest.exe";
+
+/// A host folder mapped into the sandbox, derived from the request's
+/// filesystem policy (`readwrite_paths` / `readonly_paths`).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct MappedFolder {
+    /// Host-side absolute path (must exist).
+    pub host: String,
+    /// Path the folder is exposed at inside the guest.
+    pub sandbox: String,
+    /// Whether the guest gets read-only access.
+    pub read_only: bool,
+}
+
+const TEARDOWN_POLL_TIMEOUT_SECS: u64 = 30;
+
+const TEARDOWN_COOLDOWN_SECS: u64 = 5;
+
+const TEARDOWN_POLL_INTERVAL_SECS: u64 = 2;
+
+const LAUNCH_PROOF_TIMEOUT_SECS: u64 = 30;
+
+const LAUNCH_PROOF_POLL_INTERVAL_MS: u64 = 500;
+
+/// Generate a .wsb file plus bootstrap script.
+pub fn generate_wsb(
+    guest_dir: &Path,
+    rendezvous_dir: &Path,
+    output_dir: &Path,
+    extra_mapped: &[MappedFolder],
+) -> Result<PathBuf> {
+    let bootstrap_content = format!(
+        r#"@echo off
+set "LOG={rendezvous}\bootstrap.log"
+:: Truncate any prior bootstrap.log content on this boot so its
+:: contents cannot accumulate across runs on the host.
+type nul > "%LOG%"
+
+echo [bootstrap] Starting at %date% %time% >> "%LOG%" 2>&1
+
+echo [bootstrap] PATH=%PATH% >> "%LOG%" 2>&1
+
+echo [bootstrap] Starting sandbox guest... >> "%LOG%" 2>&1
+{guest}\{binary} >> "%LOG%" 2>&1
+echo [bootstrap] Guest exited with code %ERRORLEVEL% >> "%LOG%" 2>&1
+"#,
+        rendezvous = SANDBOX_RENDEZVOUS_DIR,
+        guest = SANDBOX_GUEST_DIR,
+        binary = GUEST_BINARY,
+    );
+    let bootstrap_path = rendezvous_dir.join("bootstrap.cmd");
+    write_fresh(&bootstrap_path, &bootstrap_content)
+        .with_context(|| format!("write bootstrap script {:?}", bootstrap_path))?;
+
+    let mut mapped_xml = String::new();
+    for folder in extra_mapped {
+        let _ = write!(
+            mapped_xml,
+            "\n    <MappedFolder>\n      <HostFolder>{host}</HostFolder>\n      \
+             <SandboxFolder>{sandbox}</SandboxFolder>\n      \
+             <ReadOnly>{ro}</ReadOnly>\n    </MappedFolder>",
+            host = xml_escape(&folder.host),
+            sandbox = xml_escape(&folder.sandbox),
+            ro = folder.read_only,
+        );
+    }
+
+    let wsb_content = format!(
+        r#"<Configuration>
+  <MappedFolders>
+    <MappedFolder>
+      <HostFolder>{host_guest}</HostFolder>
+      <SandboxFolder>{sandbox_guest}</SandboxFolder>
+      <ReadOnly>true</ReadOnly>
+    </MappedFolder>
+    <MappedFolder>
+      <HostFolder>{host_rendezvous}</HostFolder>
+      <SandboxFolder>{sandbox_rendezvous}</SandboxFolder>
+      <ReadOnly>false</ReadOnly>
+    </MappedFolder>{mapped_xml}
+  </MappedFolders>
+  <LogonCommand>
+    <Command>{sandbox_rendezvous}\bootstrap.cmd</Command>
+  </LogonCommand>
+  <vGPU>Disable</vGPU>
+  <Networking>Enable</Networking>
+</Configuration>"#,
+        host_guest = xml_escape(&guest_dir.display().to_string()),
+        host_rendezvous = xml_escape(&rendezvous_dir.display().to_string()),
+        sandbox_guest = SANDBOX_GUEST_DIR,
+        sandbox_rendezvous = SANDBOX_RENDEZVOUS_DIR,
+        mapped_xml = mapped_xml,
+    );
+
+    let wsb_path = output_dir.join("wxc-windows-sandbox.wsb");
+    write_fresh(&wsb_path, &wsb_content)
+        .with_context(|| format!("write .wsb file {:?}", wsb_path))?;
+
+    Ok(wsb_path)
+}
+
+/// Minimal XML text escaping for Windows paths.
+fn xml_escape(s: &str) -> String {
+    s.replace('&', "&amp;")
+        .replace('<', "&lt;")
+        .replace('>', "&gt;")
+}
+
+/// Write a generated file as a fresh create so inherited DACLs are reapplied.
+fn write_fresh(path: &Path, content: &str) -> std::io::Result<()> {
+    match std::fs::remove_file(path) {
+        Ok(()) => {}
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+        Err(e) => return Err(e),
+    }
+    std::fs::write(path, content)
+}
+
+/// Launch Windows Sandbox with the given .wsb file.
+pub(crate) async fn launch(wsb_path: &Path) -> Result<()> {
+    eprintln!("[daemon] launching WindowsSandbox.exe with {:?}", wsb_path);
+
+    let status = Command::new("WindowsSandbox.exe")
+        .arg(wsb_path)
+        .status()
+        .await
+        .context("spawn WindowsSandbox.exe")?;
+
+    if !status.success() {
+        anyhow::bail!(
+            "WindowsSandbox.exe exited with {}",
+            status.code().unwrap_or(-1)
+        );
+    }
+    Ok(())
+}
+
+/// Capture PID+creation-time proof for host processes this launch owns.
+pub(crate) async fn capture_launch_proof() -> Vec<crate::control_plane::VmProcId> {
+    let deadline =
+        tokio::time::Instant::now() + std::time::Duration::from_secs(LAUNCH_PROOF_TIMEOUT_SECS);
+    loop {
+        if let Ok(procs) = enumerate_sandbox_vm_processes().await {
+            if !procs.is_empty() {
+                return procs;
+            }
+        }
+        if tokio::time::Instant::now() >= deadline {
+            return Vec::new();
+        }
+        tokio::time::sleep(std::time::Duration::from_millis(
+            LAUNCH_PROOF_POLL_INTERVAL_MS,
+        ))
+        .await;
+    }
+}
+
+/// Terminate a precomputed kill set and confirm sandbox host processes exit.
+pub async fn teardown_via_plan(
+    kill_set: &[crate::control_plane::VmProcId],
+) -> crate::control_plane::TeardownOutcome {
+    use crate::control_plane::TeardownOutcome;
+
+    eprintln!(
+        "[wsb-vm] tearing down sandbox ({} target process(es))",
+        kill_set.len()
+    );
+    crate::control_plane::terminate_processes(kill_set);
+
+    let deadline =
+        tokio::time::Instant::now() + std::time::Duration::from_secs(TEARDOWN_POLL_TIMEOUT_SECS);
+    loop {
+        match is_sandbox_vm_running().await {
+            Some(false) => {
+                eprintln!("[wsb-vm] all sandbox host processes confirmed gone");
+                // Cooldown for Hyper-V backend / VHDX release.
+                tokio::time::sleep(std::time::Duration::from_secs(TEARDOWN_COOLDOWN_SECS)).await;
+                return TeardownOutcome::ConfirmedGone;
+            }
+            Some(true) => {
+                if tokio::time::Instant::now() >= deadline {
+                    let remaining = enumerate_sandbox_vm_processes().await.unwrap_or_default();
+                    eprintln!(
+                        "[wsb-vm] WARNING: {} sandbox host process(es) still running after {}s; \
+                         preserving record so the next daemon can reclaim",
+                        remaining.len(),
+                        TEARDOWN_POLL_TIMEOUT_SECS
+                    );
+                    return TeardownOutcome::StillRunning(remaining);
+                }
+            }
+            None => {
+                if tokio::time::Instant::now() >= deadline {
+                    eprintln!(
+                        "[wsb-vm] WARNING: liveness probe failed during teardown wait; preserving \
+                         record"
+                    );
+                    return TeardownOutcome::ProbeFailed;
+                }
+            }
+        }
+        tokio::time::sleep(std::time::Duration::from_secs(TEARDOWN_POLL_INTERVAL_SECS)).await;
+    }
+}
+
+/// Check whether any `WindowsSandbox*` host process is running.
+pub async fn is_sandbox_vm_running() -> Option<bool> {
+    crate::control_plane::enumerate_pids_with_prefix("WindowsSandbox")
+        .map(|pids| !pids.is_empty())
+        .ok()
+}
+
+/// Enumerate running `WindowsSandbox*` host processes with PID-reuse proof.
+pub async fn enumerate_sandbox_vm_processes() -> Result<Vec<crate::control_plane::VmProcId>> {
+    crate::control_plane::enumerate_processes_with_prefix("WindowsSandbox")
+}
+
+// ---------------------------------------------------------------------------
+// Shared "launch a managed VM and connect to its guest" sequence
+// ---------------------------------------------------------------------------
+
+/// Caller hooks for the shared managed-VM launch sequence.
+pub trait LaunchObserver: Send {
+    fn set_ownership(&mut self, state: crate::control_plane::VmOwnership);
+
+    /// Persist non-empty VM process proof durably.
+    fn persist_proof(&mut self, proof: &[crate::control_plane::VmProcId]) -> anyhow::Result<()>;
+
+    /// Optional warning hook when no launch proof was captured.
+    fn note_empty_proof(&self) {
+        eprintln!(
+            "[wsb-vm] WARNING: no WindowsSandbox* host processes appeared within \
+             capture_launch_proof's budget; staying at LaunchSucceededNoProof. Teardown will \
+             enumerate-kill if any host processes are visible at exit. If the launcher hard-dies \
+             before exit, the VM may require manual cleanup."
+        );
+    }
+}
+
+/// Launch a managed VM and return a guest connection ready for EXEC dispatch.
+pub async fn launch_managed_vm(
+    wsb_path: &Path,
+    rendezvous_dir: &Path,
+    nonce: &windows_sandbox_common::auth::Nonce,
+    rendezvous_timeout: std::time::Duration,
+    rendezvous_poll_interval: std::time::Duration,
+    connect_timeout: std::time::Duration,
+    observer: &mut dyn LaunchObserver,
+) -> Result<(crate::bridge::GuestConnection, std::net::SocketAddr)> {
+    windows_sandbox_common::auth::write_nonce_file(rendezvous_dir, nonce)
+        .context("write guest nonce file")?;
+
+    observer.set_ownership(crate::control_plane::VmOwnership::LaunchInFlight);
+
+    launch(wsb_path).await.context("launch VM")?;
+
+    observer.set_ownership(crate::control_plane::VmOwnership::LaunchSucceededNoProof);
+
+    // Non-empty proof is durable reclaim state; empty proof stays as
+    // LaunchSucceededNoProof so teardown can still enumerate this live run.
+    let proof = capture_launch_proof().await;
+    if proof.is_empty() {
+        observer.note_empty_proof();
+    } else {
+        observer.set_ownership(crate::control_plane::VmOwnership::Owned(proof.clone()));
+        observer.persist_proof(&proof)?;
+    }
+
+    let addr = crate::rendezvous::wait_for_rendezvous(
+        rendezvous_dir,
+        rendezvous_timeout,
+        rendezvous_poll_interval,
+    )
+    .await
+    .context("rendezvous failed")?;
+
+    let conn = crate::bridge::connect_to_guest(addr, connect_timeout, nonce)
+        .await
+        .context("connect to guest agent")?;
+
+    Ok((conn, addr))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn generate_wsb_creates_file() {
+        let dir = tempfile::tempdir().unwrap();
+        let guest_dir = dir.path().join("guest");
+        let rendezvous_dir = dir.path().join("rendezvous");
+        std::fs::create_dir_all(&guest_dir).unwrap();
+        std::fs::create_dir_all(&rendezvous_dir).unwrap();
+
+        let wsb_path = generate_wsb(&guest_dir, &rendezvous_dir, dir.path(), &[]).unwrap();
+        assert!(wsb_path.exists());
+
+        let content = std::fs::read_to_string(&wsb_path).unwrap();
+        assert!(content.contains("<Configuration>"));
+        assert!(content.contains("bootstrap.cmd"));
+        assert!(content.contains(&guest_dir.display().to_string()));
+        assert!(content.contains(&rendezvous_dir.display().to_string()));
+
+        let bootstrap = rendezvous_dir.join("bootstrap.cmd");
+        assert!(bootstrap.exists());
+        let bootstrap_content = std::fs::read_to_string(&bootstrap).unwrap();
+        assert!(bootstrap_content.contains(GUEST_BINARY));
+        assert!(!bootstrap_content.contains("netsh advfirewall"));
+        assert!(!bootstrap_content.contains("python"));
+    }
+
+    #[test]
+    fn generate_wsb_emits_extra_mapped_folders() {
+        let dir = tempfile::tempdir().unwrap();
+        let guest_dir = dir.path().join("guest");
+        let rendezvous_dir = dir.path().join("rendezvous");
+        std::fs::create_dir_all(&guest_dir).unwrap();
+        std::fs::create_dir_all(&rendezvous_dir).unwrap();
+
+        let mapped = vec![
+            MappedFolder {
+                host: r"C:\work\proj".to_string(),
+                sandbox: r"C:\work\proj".to_string(),
+                read_only: false,
+            },
+            MappedFolder {
+                host: r"C:\data\ref".to_string(),
+                sandbox: r"C:\data\ref".to_string(),
+                read_only: true,
+            },
+        ];
+        let wsb_path = generate_wsb(&guest_dir, &rendezvous_dir, dir.path(), &mapped).unwrap();
+        let content = std::fs::read_to_string(&wsb_path).unwrap();
+        assert!(content.contains(r"C:\work\proj"));
+        assert!(content.contains(r"C:\data\ref"));
+        // The read-only flag is rendered per folder.
+        assert!(content.contains("<ReadOnly>true</ReadOnly>"));
+        assert!(content.contains("<ReadOnly>false</ReadOnly>"));
+    }
+
+    #[test]
+    fn xml_escape_escapes_metacharacters() {
+        assert_eq!(xml_escape(r"C:\a&b"), r"C:\a&amp;b");
+        assert_eq!(xml_escape("a<b>c"), "a&lt;b&gt;c");
+    }
+}
diff --git a/src/core/mxc_engine/Cargo.toml b/src/core/mxc_engine/Cargo.toml
index 27aca8142..ca32a0c8f 100644
--- a/src/core/mxc_engine/Cargo.toml
+++ b/src/core/mxc_engine/Cargo.toml
@@ -22,7 +22,7 @@ hyperlight_common = { workspace = true, optional = true }
 
 [target.'cfg(target_os = "windows")'.dependencies]
 appcontainer_common = { workspace = true }
-windows_sandbox_common = { workspace = true }
+windows_sandbox_lifecycle = { workspace = true }
 isolation_session_common = { workspace = true, optional = true }
 isolation_session_bindings = { workspace = true, optional = true }
 wslc_common = { workspace = true, optional = true }
@@ -49,4 +49,3 @@ isolation_session = [
 ]
 # Forwards appcontainer_common/tier2_bfs. OFF by default; see appcontainer_common/Cargo.toml.
 tier2_bfs = ["appcontainer_common/tier2_bfs"]
-
diff --git a/src/core/mxc_engine/src/run.rs b/src/core/mxc_engine/src/run.rs
index 316a89123..5cf6b6abd 100644
--- a/src/core/mxc_engine/src/run.rs
+++ b/src/core/mxc_engine/src/run.rs
@@ -216,16 +216,21 @@ fn resolve_runner_inner(
                     "Windows Sandbox is an experimental feature. Use --experimental flag.",
                 ));
             }
-            let sandbox_config = request
-                .experimental
-                .windows_sandbox
-                .as_ref()
-                .cloned()
-                .unwrap_or_default();
+            if let Some(ws) = &request.experimental.windows_sandbox {
+                let default = wxc_common::models::WindowsSandboxConfig::default();
+                if ws.idle_timeout_ms != default.idle_timeout_ms
+                    || ws.daemon_pipe_name != default.daemon_pipe_name
+                {
+                    let _ = writeln!(
+                        logger,
+                        "warning: experimental.windows_sandbox.idleTimeoutMs and daemonPipeName \
+                         are ignored by the one-shot backend; each invocation launches and tears \
+                         down a fresh VM"
+                    );
+                }
+            }
             Ok(ResolvedRunner::without_guard(Box::new(
-                windows_sandbox_common::windows_sandbox_runner::WindowsSandboxScriptRunner::new(
-                    &sandbox_config,
-                ),
+                windows_sandbox_lifecycle::WindowsSandboxRunner::new(),
             )))
         }
         ContainmentBackend::IsolationSession => {
@@ -367,3 +372,49 @@ fn resolve_hyperlight(request: &ExecutionRequest) -> Result<ResolvedRunner, MxcE
         ))
     }
 }
+
+#[cfg(all(test, target_os = "windows"))]
+mod tests {
+    use super::*;
+    use wxc_common::logger::Mode;
+    use wxc_common::models::{ExperimentalConfig, WindowsSandboxConfig};
+
+    fn windows_sandbox_request(config: Option<WindowsSandboxConfig>) -> ExecutionRequest {
+        ExecutionRequest {
+            containment: ContainmentBackend::WindowsSandbox,
+            experimental_enabled: true,
+            experimental: ExperimentalConfig {
+                windows_sandbox: config,
+                ..Default::default()
+            },
+            ..Default::default()
+        }
+    }
+
+    #[test]
+    fn windows_sandbox_default_settings_do_not_warn() {
+        for config in [None, Some(WindowsSandboxConfig::default())] {
+            let request = windows_sandbox_request(config);
+            let mut logger = Logger::new(Mode::Buffer);
+            resolve_runner_inner(&request, &mut logger).unwrap();
+            assert!(logger.get_buffer().is_empty());
+        }
+    }
+
+    #[test]
+    fn windows_sandbox_non_default_legacy_settings_warn() {
+        let config = WindowsSandboxConfig {
+            idle_timeout_ms: 1,
+            ..Default::default()
+        };
+        let request = windows_sandbox_request(Some(config));
+        let mut logger = Logger::new(Mode::Buffer);
+
+        resolve_runner_inner(&request, &mut logger).unwrap();
+
+        let warning = logger.get_buffer();
+        assert!(warning.contains("idleTimeoutMs"));
+        assert!(warning.contains("daemonPipeName"));
+        assert!(warning.contains("fresh VM"));
+    }
+}
diff --git a/src/core/wxc_common/src/models.rs b/src/core/wxc_common/src/models.rs
index 4007d475d..d54c604f8 100644
--- a/src/core/wxc_common/src/models.rs
+++ b/src/core/wxc_common/src/models.rs
@@ -236,10 +236,11 @@ impl From<crate::wire::LaunchMethod> for LaunchMethod {
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(default)]
 pub struct WindowsSandboxConfig {
-    /// Idle timeout in milliseconds before the daemon tears down the sandbox VM.
-    /// Default: 300 000 (5 minutes). 0 = no timeout.
+    /// Legacy daemon idle timeout. Parsed for compatibility and ignored by the
+    /// one-shot backend.
     pub idle_timeout_ms: u32,
-    /// Named pipe name the daemon listens on (without `\\.\pipe\` prefix).
+    /// Legacy daemon endpoint name. Parsed for compatibility and ignored by the
+    /// one-shot backend.
     pub daemon_pipe_name: String,
 }
 
diff --git a/src/testing/wxc_e2e_tests/tests/e2e_windows.rs b/src/testing/wxc_e2e_tests/tests/e2e_windows.rs
index c869e1902..ad135328d 100644
--- a/src/testing/wxc_e2e_tests/tests/e2e_windows.rs
+++ b/src/testing/wxc_e2e_tests/tests/e2e_windows.rs
@@ -7,25 +7,21 @@
 //! PowerShell test scripts, so failures can be debugged from Rust test code.
 //! Tests skip gracefully when prerequisites (binaries or features) are missing.
 
-use std::fs::File;
-use std::process::{Child, Command, Stdio};
 use std::sync::{Mutex, OnceLock};
-use std::thread;
-use std::time::{Duration, SystemTime, UNIX_EPOCH};
+use std::time::{SystemTime, UNIX_EPOCH};
 
 use serde::Serialize;
 use wxc_e2e_tests::{
     assert_exit, assert_pwsh, assert_python, assert_success,
-    assert_success_or_skip_missing_prerequisite, examples_dir, find_binary, has_daemon,
-    has_hyperlight_snapshot, has_nanvix_binaries, has_test_driver, has_windows_sandbox_feature,
-    has_wxc_exe, repo_root, run_test_driver, run_wxc_config, run_wxc_config_value, run_wxc_example,
-    run_wxc_state_aware, test_configs_dir, TempDirs,
+    assert_success_or_skip_missing_prerequisite, examples_dir, has_hyperlight_snapshot,
+    has_nanvix_binaries, has_test_driver, has_windows_sandbox_feature, has_wxc_exe, repo_root,
+    run_test_driver, run_wxc_config, run_wxc_config_value, run_wxc_example, run_wxc_state_aware,
+    test_configs_dir, TempDirs,
 };
 
 static HAS_WXC_EXE: OnceLock<bool> = OnceLock::new();
 static HAS_TEST_DRIVER: OnceLock<bool> = OnceLock::new();
 static HAS_NANVIX_BINARIES: OnceLock<bool> = OnceLock::new();
-static HAS_DAEMON: OnceLock<bool> = OnceLock::new();
 static HAS_WINDOWS_SANDBOX: OnceLock<bool> = OnceLock::new();
 static HAS_HYPERLIGHT: OnceLock<bool> = OnceLock::new();
 static TEST_LOCK: OnceLock<Mutex<()>> = OnceLock::new();
@@ -46,11 +42,6 @@ fn cached_has_nanvix_binaries() -> bool {
     *HAS_NANVIX_BINARIES.get_or_init(has_nanvix_binaries)
 }
 
-/// Caches the daemon probe to keep logs readable across multiple tests.
-fn cached_has_daemon() -> bool {
-    *HAS_DAEMON.get_or_init(has_daemon)
-}
-
 /// Caches the Windows Sandbox feature probe.
 fn cached_has_windows_sandbox_feature() -> bool {
     *HAS_WINDOWS_SANDBOX.get_or_init(has_windows_sandbox_feature)
@@ -401,12 +392,10 @@ fn test_windows_sandbox() {
     if !cached_has_wxc_exe() {
         return;
     }
-    if !cached_has_daemon() {
-        return;
-    }
     if !cached_has_windows_sandbox_feature() {
         return;
     }
+    // State-aware coverage lives in run_windows_sandbox_state_aware_tests.ps1.
     with_test_lock(windows_sandbox_suite);
 }
 
@@ -497,7 +486,6 @@ struct SandboxCase {
 }
 
 fn windows_sandbox_suite() {
-    let _daemon = SandboxDaemon::start();
     let cases = [
         SandboxCase {
             config: "windows_sandbox_echo.json",
@@ -577,51 +565,6 @@ fn run_sandbox_case(case: &SandboxCase) {
     );
 }
 
-struct SandboxDaemon {
-    child: Child,
-}
-
-impl SandboxDaemon {
-    fn start() -> Self {
-        let daemon = find_binary("wxc-windows-sandbox-daemon.exe")
-            .expect("wxc-windows-sandbox-daemon.exe should be available");
-        let log_path = std::env::temp_dir().join("wxc-windows-sandbox-daemon.log");
-        let stderr = File::create(&log_path).unwrap_or_else(|error| {
-            panic!(
-                "failed to create daemon log {}: {error}",
-                log_path.display()
-            )
-        });
-
-        let mut child = Command::new(&daemon)
-            .args(["wxc-windows-sandbox", "300000"])
-            .stderr(Stdio::from(stderr))
-            .spawn()
-            .unwrap_or_else(|error| panic!("failed to start {}: {error}", daemon.display()));
-
-        thread::sleep(Duration::from_secs(2));
-        if let Some(status) = child
-            .try_wait()
-            .unwrap_or_else(|error| panic!("failed to inspect daemon process: {error}"))
-        {
-            panic!(
-                "sandbox daemon exited immediately with {status}; log: {}",
-                log_path.display()
-            );
-        }
-
-        println!("Started sandbox daemon with PID {}", child.id());
-        Self { child }
-    }
-}
-
-impl Drop for SandboxDaemon {
-    fn drop(&mut self) {
-        let _ = self.child.kill();
-        let _ = self.child.wait();
-    }
-}
-
 // ---------------------------------------------------------------------------
 // MicroVM suite
 // ---------------------------------------------------------------------------
diff --git a/tests/configs/basic_windows_sandbox.json b/tests/configs/basic_windows_sandbox.json
index 072611ec0..5157eef3f 100644
--- a/tests/configs/basic_windows_sandbox.json
+++ b/tests/configs/basic_windows_sandbox.json
@@ -3,7 +3,7 @@
   "containerId": "CLI-WindowsSandbox-Hello-World",
   "containment": "windows_sandbox",
   "process": {
-    "commandLine": "python -S -B -c \"import sys; print('Hello from Windows Sandbox!'); print(f'Python version: {sys.version}'); print('Script executed successfully in sandbox isolation')\"",
+    "commandLine": "echo Hello from Windows Sandbox! && echo Script executed successfully in sandbox isolation",
     "timeout": 60000
   }
 }
diff --git a/tests/examples/09_windows_sandbox_hello_world.json b/tests/examples/09_windows_sandbox_hello_world.json
index 071c36c24..5157eef3f 100644
--- a/tests/examples/09_windows_sandbox_hello_world.json
+++ b/tests/examples/09_windows_sandbox_hello_world.json
@@ -3,7 +3,7 @@
   "containerId": "CLI-WindowsSandbox-Hello-World",
   "containment": "windows_sandbox",
   "process": {
-    "commandLine": "python -c \"import sys; print('Hello from Windows Sandbox!'); print(f'Python version: {sys.version}'); print('Script executed successfully in sandbox isolation')\"",
+    "commandLine": "echo Hello from Windows Sandbox! && echo Script executed successfully in sandbox isolation",
     "timeout": 60000
   }
 }
diff --git a/tests/examples/10_windows_sandbox_network_isolated.json b/tests/examples/10_windows_sandbox_network_isolated.json
index f5161cf58..999c259f8 100644
--- a/tests/examples/10_windows_sandbox_network_isolated.json
+++ b/tests/examples/10_windows_sandbox_network_isolated.json
@@ -3,7 +3,7 @@
   "containerId": "CLI-WindowsSandbox-Network-Isolated",
   "containment": "windows_sandbox",
   "process": {
-    "commandLine": "python -c \"import urllib.request; urllib.request.urlopen('http://example.com', timeout=5)\"",
+    "commandLine": "powershell -NoProfile -Command \"Invoke-WebRequest -Uri 'http://example.com' -TimeoutSec 5\"",
     "timeout": 30000
   }
 }
diff --git a/tests/scripts/README.md b/tests/scripts/README.md
index d830d2b32..d0fb96d53 100644
--- a/tests/scripts/README.md
+++ b/tests/scripts/README.md
@@ -28,7 +28,7 @@ All scripts accept a `-Release` switch to use the release build (default: debug)
 | `run_examples.ps1` | All examples via wxc-test-driver | `wxc-test-driver.exe` |
 | `run_microvm_basic_test.ps1` | MicroVM smoke test | `wxc-exec.exe`, NanVix binaries |
 | `run_microvm_tests.ps1` | Full MicroVM E2E suite | WHP enabled, NanVix binaries |
-| `run_windows_sandbox_tests.ps1` | Windows Sandbox E2E suite | Windows Sandbox enabled |
+| `run_windows_sandbox_one_shot_tests.ps1` | Windows Sandbox one-shot E2E suite (fresh disposable VM per test) | Windows Sandbox enabled |
 | `run_processcontainer_proxy_tests.ps1` | Process container proxy tests | `wxc-exec.exe` |
 | `run_on_repeat.ps1` | Stress test (loops core tests) | `wxc-exec.exe` |
 
diff --git a/tests/scripts/run_windows_sandbox_tests.ps1 b/tests/scripts/run_windows_sandbox_one_shot_tests.ps1
similarity index 61%
rename from tests/scripts/run_windows_sandbox_tests.ps1
rename to tests/scripts/run_windows_sandbox_one_shot_tests.ps1
index ccf0308d0..60d54c7d4 100644
--- a/tests/scripts/run_windows_sandbox_tests.ps1
+++ b/tests/scripts/run_windows_sandbox_one_shot_tests.ps1
@@ -1,13 +1,20 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT License.
 
-# Windows Sandbox E2E test runner.
-# Requires: Windows 11 Pro/Enterprise, Windows Sandbox enabled, Python on host.
+# Windows Sandbox ONE-SHOT E2E test runner.
+#
+# Exercises the disposable / fresh-VM-per-call path: every test invocation
+# launches its own brand-new Windows Sandbox VM, runs one command, then tears
+# the VM down. Each test config is independent; there is no warm-VM reuse and
+# no persistent host-side daemon. See `run_windows_sandbox_state_aware_tests.ps1`
+# for the sibling lifecycle (one provisioned VM held across multiple execs).
+#
+# Requires: Windows 11 Pro/Enterprise and Windows Sandbox enabled.
 # Cannot run in GitHub Actions CI (needs Hyper-V + Sandbox feature).
 #
 # Usage:
-#   .\run_windows_sandbox_tests.ps1              # debug build
-#   .\run_windows_sandbox_tests.ps1 -Release     # release build
+#   .\run_windows_sandbox_one_shot_tests.ps1              # debug build
+#   .\run_windows_sandbox_one_shot_tests.ps1 -Release     # release build
 
 param(
     [switch]$Release,
@@ -28,17 +35,12 @@ if (-not $BinDir) {
 }
 
 $WxcExec = Join-Path $BinDir "wxc-exec.exe"
-$Daemon = Join-Path $BinDir "wxc-windows-sandbox-daemon.exe"
 
 if (-not (Test-Path $WxcExec)) {
     Write-Host "ERROR: wxc-exec.exe not found at $WxcExec" -ForegroundColor Red
     Write-Host "Run 'cargo build$(if ($Release) { ' --release' })' first." -ForegroundColor Yellow
     exit 1
 }
-if (-not (Test-Path $Daemon)) {
-    Write-Host "ERROR: wxc-windows-sandbox-daemon.exe not found at $Daemon" -ForegroundColor Red
-    exit 1
-}
 
 # Preflight: check Windows Sandbox is available
 $sandboxFeature = dism /online /get-featureinfo /featurename:Containers-DisposableClientVM 2>&1 |
@@ -50,6 +52,44 @@ if ($sandboxFeature -notmatch "Enabled") {
 }
 
 # Helpers
+function Wait-ForSandboxIdle {
+    # Each Run-SandboxTest spawns a fresh, disposable Windows Sandbox VM. The
+    # VM's `WindowsSandbox*` host processes are reaped by the one-shot
+    # teardown path, but the `vmmem*` Hyper-V memory residue can take longer
+    # to release (Hyper-V backend cooldown). Running tests back-to-back
+    # without waiting for that residue can stack vmmem processes and OOM the
+    # host on memory-constrained machines.
+    #
+    # Wait until: no WindowsSandbox* processes remain AND fewer than 2 vmmem*
+    # processes remain (one residual is normal — vmmemCmZygote always exists
+    # on hosts with Containers feature enabled).
+    param([int]$TimeoutSec = 60)
+
+    $deadline = (Get-Date).AddSeconds($TimeoutSec)
+    while ((Get-Date) -lt $deadline) {
+        $wsb = @(Get-Process -Name "WindowsSandbox*" -ErrorAction SilentlyContinue)
+        $vmmem = @(Get-Process -Name "vmmem*" -ErrorAction SilentlyContinue)
+        if ($wsb.Count -eq 0 -and $vmmem.Count -le 1) {
+            return $true
+        }
+        Start-Sleep -Seconds 2
+    }
+    Write-Host "    [warn] sandbox processes still present after ${TimeoutSec}s settle wait" -ForegroundColor Yellow
+    return $false
+}
+
+function Test-MemoryHeadroom {
+    # If free memory is below 2 GB we cannot safely spin another sandbox VM
+    # (each VM reserves ~1-1.5 GB minimum). Skip rather than risk OOM.
+    $os = Get-CimInstance Win32_OperatingSystem
+    $freeMb = [int]($os.FreePhysicalMemory / 1024)
+    if ($freeMb -lt 2048) {
+        Write-Host "    [skip] insufficient free memory (${freeMb} MB free, need >=2048 MB)" -ForegroundColor Yellow
+        return $false
+    }
+    return $true
+}
+
 function Run-SandboxTest {
     param(
         [string]$ConfigFile,
@@ -65,6 +105,13 @@ function Run-SandboxTest {
 
     Write-Host "  Running $ConfigFile... " -NoNewline
 
+    # Pre-flight: ensure prior test's VM has fully released, and we have
+    # enough free memory to launch another VM.
+    [void](Wait-ForSandboxIdle -TimeoutSec 60)
+    if (-not (Test-MemoryHeadroom)) {
+        return @{ Name = $ConfigFile; Pass = $false; Reason = "Insufficient memory for new VM" }
+    }
+
     # wxc-exec outputs base64-encoded stdout/stderr when not attached to a
     # terminal (e.g. when daemon was started via Start-Process). We capture
     # everything and try to decode any base64 lines we find.
@@ -128,17 +175,15 @@ Get-Process -Name "wxc-windows-sandbox-daemon","WindowsSandbox*" -ErrorAction Si
 Remove-Item "$env:TEMP\wxc-sandbox-rendezvous\*" -ErrorAction SilentlyContinue
 Start-Sleep 5
 
-# Start daemon
-Write-Host "Starting sandbox daemon..." -ForegroundColor Yellow
-$daemonProc = Start-Process -FilePath $Daemon -ArgumentList "wxc-windows-sandbox","300000" `
-    -PassThru -NoNewWindow -RedirectStandardError "$env:TEMP\wxc-windows-sandbox-daemon.log"
-Start-Sleep 2
-
-if ($daemonProc.HasExited) {
-    Write-Host "ERROR: Daemon exited immediately. Check $env:TEMP\wxc-windows-sandbox-daemon.log" -ForegroundColor Red
-    exit 1
-}
-Write-Host "Daemon started (PID $($daemonProc.Id))`n" -ForegroundColor Green
+# The one-shot Windows Sandbox path (`containment: "windows_sandbox"` with no
+# state-aware phase envelope) spawns a fresh, disposable VM per invocation
+# directly from `wxc-exec.exe`. It does NOT use the persistent
+# `wxc-windows-sandbox-daemon.exe` — that daemon is now exclusively for the
+# state-aware lifecycle (see run_windows_sandbox_state_aware_tests.ps1).
+# Earlier versions of this script pre-spawned the daemon to drive a
+# warm-reuse one-shot path that no longer exists; that pre-spawn now just
+# breaks (the daemon requires `--token` + stdin nonce, not positional args).
+Write-Host "Using fresh-VM-per-call one-shot path (no pre-spawned daemon).`n" -ForegroundColor Yellow
 
 # Run tests
 [System.Collections.ArrayList]$results = @()
@@ -154,7 +199,7 @@ $null = $results.Add((Run-SandboxTest "windows_sandbox_exit_code.json" -Expected
 Write-Host "`n--- Timeout Test ---" -ForegroundColor Cyan
 $null = $results.Add((Run-SandboxTest "windows_sandbox_timeout.json" -ExpectNonZero))
 
-Write-Host "`n--- Multi-Exec Test (3x echo on same VM) ---" -ForegroundColor Cyan
+Write-Host "`n--- Multi-Exec Test (3x echo, each on its own fresh VM) ---" -ForegroundColor Cyan
 for ($iter = 1; $iter -le 3; $iter++) {
     $result = Run-SandboxTest "windows_sandbox_echo.json" -OutputContains "Hello from sandbox!"
     $result.Name = "multi-exec #$iter (windows_sandbox_echo.json)"
@@ -177,13 +222,8 @@ if ($failed -eq 0) {
 }
 
 # Cleanup
-Write-Host "`nStopping daemon..." -ForegroundColor Yellow
-if (-not $daemonProc.HasExited) {
-    Stop-Process -Id $daemonProc.Id -Force -ErrorAction SilentlyContinue
-}
-Get-Process -Name "WindowsSandbox*" -ErrorAction SilentlyContinue |
+Write-Host "`nFinal cleanup of any lingering Windows Sandbox processes..." -ForegroundColor Yellow
+Get-Process -Name "WindowsSandbox*","wxc-windows-sandbox-daemon" -ErrorAction SilentlyContinue |
     ForEach-Object { Stop-Process -Id $_.Id -Force -ErrorAction SilentlyContinue }
 
-Write-Host "Daemon log: $env:TEMP\wxc-windows-sandbox-daemon.log" -ForegroundColor Gray
-
 exit $(if ($failed -gt 0) { 1 } else { 0 })