feat(sandbox): per-session windows-acl write grant with dual-mode restricting lists and a private temp subdirectory

docs/config-catalog.md

@@ -1181,7 +1181,7 @@ export interface Config {
 }
 ```
 
-Source: [`packages/sandbox/sandbox-local/src/index.ts:28`](../packages/sandbox/sandbox-local/src/index.ts)
+Source: [`packages/sandbox/sandbox-local/src/index.ts:39`](../packages/sandbox/sandbox-local/src/index.ts)
 
 ## `@deepseek-ai/dsh-sandbox-policy`
 
@@ -2019,7 +2019,7 @@ export interface Config {
 }
 ```
 
-Source: [`packages/bash/tool-pwsh/src/index.ts:43`](../packages/bash/tool-pwsh/src/index.ts)
+Source: [`packages/bash/tool-pwsh/src/index.ts:47`](../packages/bash/tool-pwsh/src/index.ts)
 
 ## `@deepseek-ai/dsh-tool-ralph`
 

docs/cordis-catalog/services.md

@@ -1160,7 +1160,7 @@ abstract confine(argv: readonly string[], policy: SandboxPolicy): ConfinedArgv
 
 Types: [ConfinedArgv](../core-data-structures/sandbox.md) · [SandboxPolicy](../core-data-structures/sandbox.md)
 
-Source: [`packages/sandbox/sandbox/src/index.ts:148`](../../packages/sandbox/sandbox/src/index.ts)
+Source: [`packages/sandbox/sandbox/src/index.ts:155`](../../packages/sandbox/sandbox/src/index.ts)
 
 ## `ctx.sandboxPolicy` — `SandboxPolicyService`
 

docs/core-data-structures/sandbox.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/core-data-structures/sandbox.md
-sandbox.md: af2b9043c52f35b7f38b368de1420d0e2856a963
-sandbox.zh.md: 5638e76769639525b1884756805d0e0cef1e870e
+sandbox.md: a9a1fec080e1cf86ea63e02e062b775cd6d4d0da
+sandbox.zh.md: 99505265a9c440a14cc0cfc5473823ca5514984c

docs/core-data-structures/sandbox.md

@@ -53,6 +53,13 @@ interface SandboxExecutionPolicy {
   mode: SandboxMode
   /** Absolute root directory `workspace-write` may write under. */
   workspaceRoot: string
+  /**
+   * Opaque identity of the calling session (the `dsh-session` SessionId in
+   * string form). Backends key per-session state off it (e.g. the windows-acl
+   * per-session write grant and private temp subdirectory); absent for
+   * agentless calls, which fall back to per-call backend state.
+   */
+  sessionId?: string
 }
 ```
 

docs/core-data-structures/sandbox.zh.md

@@ -53,6 +53,13 @@ interface SandboxExecutionPolicy {
   mode: SandboxMode
   /** Absolute root directory `workspace-write` may write under. */
   workspaceRoot: string
+  /**
+   * Opaque identity of the calling session (the `dsh-session` SessionId in
+   * string form). Backends key per-session state off it (e.g. the windows-acl
+   * per-session write grant and private temp subdirectory); absent for
+   * agentless calls, which fall back to per-call backend state.
+   */
+  sessionId?: string
 }
 ```
 

docs/persistence-catalog.md

@@ -477,6 +477,29 @@ Source: [`packages/core/session/src/types.ts:276`](../packages/core/session/src/
 
 ### `sandbox/*`
 
+#### `sandbox/acl-session` — log-only
+
+```ts persistence-catalog
+/**
+ * The session's windows-acl write identity was provisioned — log-only
+ * (like `sandbox/mode`; NOT a surface event, carries no `surfaceOp`):
+ * durable and replayable, never in the model transcript. The LAST such
+ * event is the session's record ({@link sessionAclRecord}); the
+ * provider appends exactly one on the session's first Windows confined
+ * execution.
+ */
+'sandbox/acl-session': {
+  /** The orphan write SID (`S-1-4-x-y`) whose ACEs form the session's write allowlist. */
+  writeSid: string
+  /** The workspace root the grant applies to (the session's immutable cwd, as resolved). */
+  workspace: string
+  /** The session's private temp subdirectory under the host temp root. */
+  tempDir: string
+}
+```
+
+Source: [`packages/sandbox/sandbox-local/src/acl-session.ts:34`](../packages/sandbox/sandbox-local/src/acl-session.ts)
+
 #### `sandbox/mode` — log-only
 
 ```ts persistence-catalog