Electron #

The desktop shell owns window lifecycle and privileged operating-system access. The renderer remains sandboxed and receives a narrow API rather than unrestricted Electron or Node.js access.

This is the trust boundary: requests must be authorized and validated here before reaching the filesystem. Shared API types describe the contract but do not replace runtime checks.

Document editing stays in the renderer's Zig WASM engine. The desktop shell must not maintain a second live document model.