docs: finalize v1 design and Windows service model

docs/protocol.md

@@ -59,6 +59,14 @@ on `issue_uuid`. A client whose queue is full sends a transient capacity
 rejection, which the server requeues with backoff. A permanent validation or
 unsupported-platform rejection makes the server command terminal `rejected`;
 it is not retried or mislabeled as a launched-process failure.
+`ExecutionSpec.elevated=false` requests normal privilege and true requests the
+platform's elevated policy; non-Windows clients reject true in v1. Windows
+resolves the effective token/session immediately before launch. With a usable
+active user, false selects a verified non-elevated `ACTIVE_USER`; true tries
+`ACTIVE_USER_ELEVATED`, `ACTIVE_SYSTEM`, then `LOCAL_SYSTEM`. With no usable
+active user, false selects `LOCAL_SERVICE` and true selects `LOCAL_SYSTEM`.
+Fallback is confined to token selection before `launch_prepared`; it is never a
+process retry. Token/session attempts and effective identity are durable history.
 An exact UUID/request-hash hit in the compact tombstone ledger returns
 `CODE_ALREADY_EXECUTED`; the server suppresses dispatch and reconciles its stale
 state instead of representing the prior execution as a new rejection.
@@ -137,6 +145,20 @@ authorization. User cancellation in that interval emits `cancelled`; an
 uncertain crash window emits `interrupted`. None is mislabeled as process
 `failed`.
 
+On Windows, a context-selection rejection or the `running` lifecycle event
+carries `WindowsExecutionIdentity`; later lifecycle events repeat it unchanged.
+The server persists it into `CommandRecord`. If selection exhausted every
+allowed context, `effective_context` and the effective/session identity fields
+are absent. Session 0 effective contexts omit session fields.
+Active contexts include both the target session/user SID and actual process-
+token SID so `ACTIVE_SYSTEM` cannot be mistaken for execution as the desktop
+owner. The ordered `attempted_contexts` and bounded `selection_detail` explain
+fallback caused by a standard user, absent linked token, Administrator
+Protection, or failed active-SYSTEM token construction. `selection_detail` and
+every individual reason embedded in it are subject to the common 4 KiB detail
+limit. Token selection and this event are downstream of durable acceptance but
+upstream of requested code execution.
+
 ## Flow control and failure containment
 
 No receive loop runs an executor, database write, decompressor, or slow socket