# beyond_backglow_ctl

VRChat OSC-to-LED-pipe bridge daemon. Launched + kept alive by
`DeviceProvider::InitBackglow` (Phase 16). Listens for
`/avatar/parameters/Backglow*` on 127.0.0.1 (OSCQuery-assigned UDP port
with fallback 9001) and translates to `backglow fill|bri|off` commands
on `\\.\pipe\beyond_proximity_ctl`.

See `.planning/phases/16-vrchat-osc-bridge/16-CONTEXT.md` for locked
decisions D-01..D-26 and `16-RESEARCH.md` for code examples.

## Local trust domain (D-20)

- **OSC UDP** binds loopback-only (`127.0.0.1`). Per D-20 any local process
  in the interactive session may send OSC frames to the daemon; Windows
  Firewall's default loopback rules block off-box traffic. No further ACL
  is applied at the socket level (Winsock lacks a practical mechanism for
  restricting loopback senders without LSP tricks).
- **Driver pipe** (`\\.\pipe\beyond_backglow_daemon`) is hardened with an
  explicit DACL (WR-02 iter-4): write access is restricted to SYSTEM,
  Builtin Administrators, and the Interactive user. This prevents e.g.
  sandboxed low-integrity processes in other logon sessions from injecting
  `backglow fill|bri|off` frames at the PollDaemonPipe rate.