feat(sandbox): per-session windows-acl write grant with dual-mode restricting lists and a private temp subdirectory

docs/persistence-catalog.md

@@ -477,6 +477,29 @@ Source: [`packages/core/session/src/types.ts:276`](../packages/core/session/src/
 
 ### `sandbox/*`
 
+#### `sandbox/acl-session` — log-only
+
+```ts persistence-catalog
+/**
+ * The session's windows-acl write identity was provisioned — log-only
+ * (like `sandbox/mode`; NOT a surface event, carries no `surfaceOp`):
+ * durable and replayable, never in the model transcript. The LAST such
+ * event is the session's record ({@link sessionAclRecord}); the
+ * provider appends exactly one on the session's first Windows confined
+ * execution.
+ */
+'sandbox/acl-session': {
+  /** The orphan write SID (`S-1-4-x-y`) whose ACEs form the session's write allowlist. */
+  writeSid: string
+  /** The workspace root the grant applies to (the session's immutable cwd, as resolved). */
+  workspace: string
+  /** The session's private temp subdirectory under the host temp root. */
+  tempDir: string
+}
+```
+
+Source: [`packages/sandbox/sandbox-local/src/acl-session.ts:34`](../packages/sandbox/sandbox-local/src/acl-session.ts)
+
 #### `sandbox/mode` — log-only
 
 ```ts persistence-catalog