[ken-jo]

On Windows, srt-win acl stamp must create a missing denyRead/denyWrite target before it can write the access entry on it. Missing parent directories are created as directories, and the path itself as an empty file unless the entry ends in a separator. These are left on disk after the session ends.

Embedders hit this when they deny a directory they only create later. The deny turns it into a zero-byte file, and the embedder's own mkdir then fails with EEXIST on every later run. Today this rule and the trailing-separator convention are documented only in source comments (cli.rs canonicalize_ace_targets, path_id.rs create_placeholder_chain) and in the JSDoc of expandWindowsFsPaths; the README covers only the Linux case.

This adds a Windows paragraph next to the Linux one. It covers:

• what gets created;
• that it is left on disk;
• the EEXIST consequence, and the two ways to avoid it: a trailing separator, or creating the directory first;
• that the separator matters only when the path is missing;
• that UNC paths and locations the user cannot create in are dropped.

Docs only, no behaviour change. The behaviour is already pinned by test/sandbox/glob-expand.test.ts ("preserves trailing separator on passed-through deny") and by path_id.rs placeholder_chain_round_trip. I also checked the file and directory cases against the srt-win binary.

This does not take a side on the open question in #657 (part 2): whether placeholders should be removed on restore, or be opt-out.

Validation: git diff --check.

🤖 Generated with Claude Code