The probe now uses [Environment]::IsPrivilegedProcess and reports PASS when CIM availability matches the child's privilege, FAIL otherwise; both runner cases assert PASS.
Preserve the persistent runtime package description with master's alpha.2 version and locale exports. Refresh the two PTC prompt snapshots for the current plan-tool result type.
Validation: full build, 434 focused tests (one skipped), two built-runtime tests, two selected snapshots, package metadata, and all 43 doc-sync checks passed.
Delete @deepseek-ai/dsh-invariants, every package's ./invariant companion
and its tests, the invariant gates and Vitest setup, the scoped-event
resolver generator, and the INVARIANT-coded listener rethrow paths.
Update docs, READMEs, Agent Notes, and add an upgrade guide.
The classification was recorded before the subtree scan, so a run that found and
removed package ACEs under the requested directory still reported NOT_THIS_CLASS
or PRECONDITION with an empty packageObjects, contradicting README and SKILL. The
scan now runs first, so the verdict and packageObjects describe what the run
actually repairs.
A report-file write failure now prints REPORT_IO_FAILED with the path and the
error on stderr instead of silently leaving an incomplete report behind.
The desktop archive probe called the script with only -Path, which the new
interface refuses, so it now passes -AllowRoot and -Out. The skill no longer
suggests running the repair confined: the confined token cannot write a DACL, so
that run would report the sandbox's own restriction as a missing right.
The subtree walk bounds its first enumeration too, and a directory whose stat
fails counts as unreadable instead of vanishing. The removal decision says
inherited copies follow their repaired source, and the pre-flight comment names
grant targets as well. Add the third behavior test the rewrite dropped: an
inherit-only FullControl ACE survives a grant.
The approval rule and the stop template are the text a user reads, so they now
name Windows file permissions and permission entries; ACL and ACE stay in the
model-facing technical sections and the report.
The stop paragraph now says only the user can lift confinement, names the term
the Chinese UI shows (完全权限), and offers both options that switch opens: keep
working under full access, or have the agent keep investigating the ACL problem
from the report's mechanism and evidence. A bilingual template carries the same
message, and the surrounding skill text is tightened to stay inside its budget.
The stop path told the agent to switch the session to full access, which only the
user can do. Ask them to switch it instead, keep the agent out of that decision,
and record the same wording in the windows-acl-skill snapshot.
imccyu